Attribution is not established. The GMO findings do not identify a specific actor. Silicon UK named Daiwa Securities, East Japan Railway and SoftBank as affected companies, but that list has not been confirmed in other reporting. The campaign follows a similar wave against South Korea, where CrowdStrike documented Artex-linked breaches at banks and other financial institutions in early October. After those breaches became public, the developer revised the usage terms to bar unauthorized access and data theft, halted public release and said it will no longer update the project. The developer called misuse "entirely contrary to" its intentions.
For attorneys, the key point is how little effort the attacks required. In a simulated attack by Tokyo firm S&J, its president said, "All we had to do was give it three lines of instructions in Japanese." Dozens of firms have disclosed unauthorized access or breaches in recent weeks, potentially affecting millions of customers. Clients in insurance, finance and logistics should be reviewed for exposure and breach-notification obligations, and their vendors' security should be checked as well. Watch for further disclosures from the eight firms that have already reported breaches, any law enforcement action tied to the GMO findings, and any formal government guidance following the Japanese government's call for stronger cyber defenses.