Cybersecurity breaches explained through security impact, team responsibilities, and practical hunting. Independent analysis in English and Japanese.https://secopsnomad.si/enhttps://secopsnomad.si/blog/artex-agentic-pattern-japan-2026/https://secopsnomad.si/blog/artex-agentic-pattern-japan-2026/TrendAI found three attacker servers aimed at Japan, one running CyberStrikeAI with 44 agents. Microsoft ties ARTEX to Storm-0940. What is proved, what is not, and how to detect it.Tue, 20 Oct 2026 03:30:00 GMThttps://secopsnomad.si/blog/windows-dfir-03-autopsy-and-axiom/https://secopsnomad.si/blog/windows-dfir-03-autopsy-and-axiom/Part 3 of a free Windows DFIR course: open an E01, run ingest, search, tag, build a timeline and report in Autopsy 4.23, repeat it in Magnet Axiom, and compare the two tools.Wed, 28 Oct 2026 08:30:00 GMThttps://secopsnomad.si/blog/arctic-ice-melt-geopolitics/https://secopsnomad.si/blog/arctic-ice-melt-geopolitics/Dated forecasts with probabilities for Arctic shipping, oil and LNG, and which countries gain or lose, built on Russia's missed targets, a voyage-cost model and the 2026 Hormuz shock.Tue, 06 Oct 2026 23:10:00 GMThttps://secopsnomad.si/blog/security-from-zero-05-accounts-authentication-access/https://secopsnomad.si/blog/security-from-zero-05-accounts-authentication-access/Understand accounts, passwords, MFA, passkeys, sessions and permissions through eight diagrams, ten access decisions and a fictional sign-in investigation.Wed, 28 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/japan-breaches-how-timeline-risk-model/https://secopsnomad.si/blog/japan-breaches-how-timeline-risk-model/Where to find how breaches are really done, a dated timeline to 25 October 2026, and a reproducible risk model on 264 Japanese notices: a heavy tail and supplier cascades.Sun, 25 Oct 2026 03:30:00 GMThttps://secopsnomad.si/blog/lawson-id-app-data-exposure/https://secopsnomad.si/blog/lawson-id-app-data-exposure/Names, plus phone numbers, addresses and possibly dates of birth, for 2,155,345 Lawson ID accounts; Lawson corrected on 24 October that email addresses did not leak. What to check.Thu, 08 Oct 2026 12:45:00 GMThttps://secopsnomad.si/blog/japan-breach-year-2026/https://secopsnomad.si/blog/japan-breach-year-2026/The 38 largest disclosures of the past 12 months and all 153 notices of the last 60 days, sorted by how the data got out: apps and APIs, analytics tools, suppliers, accounts, ransomware.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/sagawa-tracking-lookup-100-days/https://secopsnomad.si/blog/sagawa-tracking-lookup-100-days/Sender and recipient details for about 100 days of parcels may have leaked through a tracking lookup. What that means for your own public lookup services, and for companies that ship with a carrier.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/php2shell-prime-minister-patch-call/https://secopsnomad.si/blog/php2shell-prime-minister-patch-call/At 21:55 on 21 October, Sanae Takaichi asked website owners to patch PHP that night, or switch their sites off. What PHP2Shell is, how much of Japan it reaches, and what to do now.Wed, 21 Oct 2026 17:12:00 GMThttps://secopsnomad.si/blog/security-from-zero-04-security-logs/https://secopsnomad.si/blog/security-from-zero-04-security-logs/Read Windows logon events, handle timestamps and duplicate records, and build a small evidence-led timeline and triage note for your analyst portfolio.Wed, 21 Oct 2026 17:15:00 GMThttps://secopsnomad.si/blog/security-from-zero-03-operating-systems/https://secopsnomad.si/blog/security-from-zero-03-operating-systems/Learn the Windows and Linux basics behind an alert. Read files, accounts, permissions, processes and services, and build a small system-observation report.Wed, 21 Oct 2026 12:03:01 GMThttps://secopsnomad.si/blog/security-from-zero-02-networking/https://secopsnomad.si/blog/security-from-zero-02-networking/Follow a web request from DNS to a process. Learn addresses, ports, TCP, UDP and HTTP, then build a connection note you can explain in a SOC interview.Wed, 21 Oct 2026 12:03:00 GMThttps://secopsnomad.si/blog/security-from-zero-01-blue-team-and-study-plan/https://secopsnomad.si/blog/security-from-zero-01-blue-team-and-study-plan/Start toward a SOC or junior security analyst role. Learn the job, inspect your own PC with three everyday tools, and write a first portfolio note.Wed, 21 Oct 2026 09:00:00 GMThttps://secopsnomad.si/blog/dkim-replay-dmarc-limits/https://secopsnomad.si/blog/dkim-replay-dmarc-limits/What the October phishing report describes, the signing gap behind it, and the checks that matter in Proofpoint Enterprise Email Protection and TAP.Mon, 19 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/windows-dfir-02-collecting-evidence/https://secopsnomad.si/blog/windows-dfir-02-collecting-evidence/Part 2 of a free Windows DFIR course: what to collect first, memory and triage capture, BitLocker checks, E01 imaging with FTK Imager, and an exercise you can verify.Mon, 19 Oct 2026 13:00:00 GMThttps://secopsnomad.si/blog/windows-dfir-01-investigation-and-lab/https://secopsnomad.si/blog/windows-dfir-01-investigation-and-lab/Part 1 of a free Windows DFIR course: the method investigators follow, rules for handling evidence, the tools (Autopsy, Magnet and more), a lab, and a first case you can check yourself.Mon, 19 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/api-leaks-find-and-fix-guide/https://secopsnomad.si/blog/api-leaks-find-and-fix-guide/At least ten Japanese companies said data left through their apps, APIs or lookup pages this autumn. How to find every API you run, test it, fix it and watch it, with queries and templates.Sun, 18 Oct 2026 10:40:00 GMThttps://secopsnomad.si/blog/satellite-networks-war-sovereignty/https://secopsnomad.si/blog/satellite-networks-war-sovereignty/Satellite networks are becoming strategic infrastructure. A sourced comparison of Starlink, Russia’s Rassvet and emerging alternatives—and what dependence means for Japan and security teams.Sat, 17 Oct 2026 17:00:00 GMThttps://secopsnomad.si/blog/burger-king-japan-app-breach/https://secopsnomad.si/blog/burger-king-japan-app-breach/BK Japan says its app's member system was accessed from 2 to 7 October. What leaked, what the dates show, and an outside-in risk card for its internet-facing systems, scored without the details.Sat, 17 Oct 2026 12:00:00 GMThttps://secopsnomad.si/blog/yamato-kuroneko-atobarai-billing-data/https://secopsnomad.si/blog/yamato-kuroneko-atobarai-billing-data/Yamato confirms stolen buyer, recipient and merchant records. What changed on 16 October, what did not leak, and how to verify payment requests.Sat, 03 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/api-data-exposure-playbook/https://secopsnomad.si/blog/api-data-exposure-playbook/36 decisions to contain API data exposure, preserve evidence, scope records and people, repair authorization and verify recovery. Visual maps, KQL/Splunk and response templates.Fri, 16 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/sourcenext-22-million-member-api/https://secopsnomad.si/blog/sourcenext-22-million-member-api/The company behind the ZERO antivirus range, Fudegurume and Pocketalk says a member API was misused for four days. What leaked, who its customers are, and what they should check.Thu, 15 Oct 2026 11:55:00 GMThttps://secopsnomad.si/blog/virustotal-internet-scanning-infrastructure-hunting/https://secopsnomad.si/blog/virustotal-internet-scanning-infrastructure-hunting/New daily public-IPv4 scans bring port histories, banners and fingerprints to VirusTotal. See what changed, where to find it and how to pivot to related infrastructure.Tue, 13 Oct 2026 08:33:13 GMThttps://secopsnomad.si/blog/idc-frontier-idcf-cloud-ransomware/https://secopsnomad.si/blog/idc-frontier-idcf-cloud-ransomware/Ransomware hit IDCF Cloud on 7 October 2026. The 14 October report: backups for 194 customers, no sign data left their servers, 48 portal records viewed; new notices from Mouse, Izumi, JR Central.Mon, 12 Oct 2026 01:35:00 GMThttps://secopsnomad.si/blog/undersea-cables-geopolitical-fault-lines/https://secopsnomad.si/blog/undersea-cables-geopolitical-fault-lines/A visual guide to cable corridors, political control, repair delays and shared dependencies. Why two providers can still mean one physical risk, and what genuine resilience requires.Thu, 15 Oct 2026 03:40:00 GMThttps://secopsnomad.si/blog/skyticket-three-intrusions-a2b/https://secopsnomad.si/blog/skyticket-three-intrusions-a2b/The travel site disclosed three intrusions on 9 October. Four days later NICT warned of “A2B” attacks that start by analysing a company's app. What leaked, how the routes differ, and what to check.Wed, 14 Oct 2026 16:30:00 GMThttps://secopsnomad.si/blog/japan-cyber-emergency-october-2026/https://secopsnomad.si/blog/japan-cyber-emergency-october-2026/On 8 and 9 October a minister and the ruling party called Japan's wave of breaches critical, even an emergency. What was said, what it does and does not mean, and what our numbers showed first.Tue, 13 Oct 2026 08:00:00 GMThttps://secopsnomad.si/blog/asahi-kasei-pharma-digital-hcp-data/https://secopsnomad.si/blog/asahi-kasei-pharma-digital-hcp-data/Asahi Kasei Therapeutics’ HCP site was breached at its operator. Why specialty-tagged HCP data and MR photos fuel targeted phishing, and what pharma teams should check now.Tue, 06 Oct 2026 17:19:59 GMThttps://secopsnomad.si/blog/his-thailand-file-server-passports/https://secopsnomad.si/blog/his-thailand-file-server-passports/Passport details and allergy notes for up to 627 travellers may have been taken from an overseas file server. Why scoping took 300 days, and what to check in your own subsidiaries.Wed, 07 Oct 2026 08:05:00 GMThttps://secopsnomad.si/blog/plaza-accord-yen-40-years/https://secopsnomad.si/blog/plaza-accord-yen-40-years/In 1985 the US pushed the dollar down and the yen up. Forty years on, the yen is at its weakest in real terms since 1964 and Washington is buying it. What changed, and where the yen goes next.Wed, 07 Oct 2026 05:55:00 GMThttps://secopsnomad.si/blog/rakuten-drive-admin-access/https://secopsnomad.si/blog/rakuten-drive-admin-access/Files linked to 15,382 accounts were accessed or obtained. Separate profile and password-data exposures show why cloud incidents need both privilege and data-impact reviews.Tue, 06 Oct 2026 11:43:49 GMThttps://secopsnomad.si/blog/murauchi-outage-exposed-breach/https://secopsnomad.si/blog/murauchi-outage-exposed-breach/A night-time system failure led to traces of an intrusion that began at a web-system vulnerability. What the two notices say, what changed between them, and what online retailers should check.Tue, 06 Oct 2026 02:58:00 GMThttps://secopsnomad.si/blog/times-car-retained-id-documents/https://secopsnomad.si/blog/times-car-retained-id-documents/About 6.6 million accounts and identity documents for 1.6 million. Updated with Japanese licence images for sale on a dark-web site and 40,000 lawsuit sign-ups.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/daiwa-supplier-inquiry-exposure/https://secopsnomad.si/blog/daiwa-supplier-inquiry-exposure/Daiwa’s supplier inquiry-data incident explained: reported scope, unknowns, fraud implications, team actions and scoped KQL/Splunk hunting templates.Mon, 05 Oct 2026 04:49:46 GMThttps://secopsnomad.si/blog/customer-account-takeover-playbook/https://secopsnomad.si/blog/customer-account-takeover-playbook/A visual playbook for credential stuffing and takeover of customer accounts in apps, shops and points programmes: contain, reverse fraud, notify and harden, with KQL/Splunk starters.Tue, 06 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/infoq-member-data-points-exchange/https://secopsnomad.si/blog/infoq-member-data-points-exchange/A software vulnerability exposed all 948,498 records of the GMO survey site infoQ, and 611 accounts had points exchanged without consent. What points operators, SOCs and members should check.Tue, 06 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/leaked-cloud-keys-playbook/https://secopsnomad.si/blog/leaked-cloud-keys-playbook/A visual playbook for exposed AWS access keys, Entra app secrets and API tokens: contain the key and its sessions, scope what it could do and did, remove persistence, with KQL/Splunk starters.Tue, 06 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/supplier-breach-playbook/https://secopsnomad.si/blog/supplier-breach-playbook/A visual playbook for when a supplier, SaaS provider or contractor reports a breach: what to ask, what to cut off, what to hunt for and who must be told, with KQL/Splunk starters.Tue, 06 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/account-compromise-playbook/https://secopsnomad.si/blog/account-compromise-playbook/A visual account-compromise playbook with 36 decisions across the kill chain, stolen sessions, MFA, mailbox and app access, with KQL/Splunk starters.Sat, 03 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/phishing-response-playbook/https://secopsnomad.si/blog/phishing-response-playbook/Nine core decisions, 30 detailed checks and five visual maps across email, identity, devices and business impact, with KQL/Splunk starters.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/ransomware-incident-playbook/https://secopsnomad.si/blog/ransomware-incident-playbook/A visual incident playbook with 36 decisions across the Cyber Kill Chain, containment, data theft and recovery, with KQL and Splunk examples.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/yakiniku-king-app-breach/https://secopsnomad.si/blog/yakiniku-king-app-breach/Verified scope of the Yakiniku King app breach, impersonation and recovery risks, team actions, decision branches and scoped KQL/Splunk hunting templates.Mon, 05 Oct 2026 10:41:24 GMThttps://secopsnomad.si/blog/gpoint-member-identifiers-outage/https://secopsnomad.si/blog/gpoint-member-identifiers-outage/G Point’s incident explained: identifier scope, outage and point protection, partner reconciliation, team responsibilities and KQL/Splunk review templates.Mon, 05 Oct 2026 05:08:06 GMThttps://secopsnomad.si/blog/osaka-metropolitan-university-ransomware/https://secopsnomad.si/blog/osaka-metropolitan-university-ransomware/All five campuses lost their systems on 2 October. Data on at least 130,000 students and graduates may have leaked. What a shared virtualisation platform and reachable backups mean for recovery.Mon, 05 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/election-security-enterprise/https://secopsnomad.si/blog/election-security-enterprise/An evidence-led analysis of election security: identity, voter data, suppliers, DDoS, AI impersonation, recovery and scoped KQL/Splunk examples.Sun, 04 Oct 2026 15:46:00 GMThttps://secopsnomad.si/blog/big-four-apt-2026/https://secopsnomad.si/blog/big-four-apt-2026/A research brief on the 'Big Four' state actors in 2025–26: their mandates, who they hit (Japan is 20% of China-linked targeting in Microsoft's data), and the hunts that follow.Sun, 04 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/nikkei-m365-impersonation-mail/https://secopsnomad.si/blog/nikkei-m365-impersonation-mail/Mail from a real Nikkei account led recipients to a malicious site on 30 September. What recipients should check, and why the stated fix, a password change, is not the whole recovery.Sun, 04 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/crypto-losses-q3-2026/https://secopsnomad.si/blog/crypto-losses-q3-2026/CertiK counts 248 incidents and a 54% rise in Q3 2026, but only 10% after returned funds. Bitget's $387.5M theft began with a zero-day in a security product. What security teams should learn.Sat, 03 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/sakura-internet-sales-system-access/https://secopsnomad.si/blog/sakura-internet-sales-system-access/1,360,563 member records may have been viewed, and the sales system also stored unhashed server and VPS passwords. What hosting customers should rotate, check and hunt for.Sat, 03 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/shadow-ai-si-domains/https://secopsnomad.si/blog/shadow-ai-si-domains/A US rename and a .si registration rush give unvetted AI tools a new name that word-based proxy, DLP and policy controls may not catch.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/ta419-aitm-policy-phishing/https://secopsnomad.si/blog/ta419-aitm-policy-phishing/A China-aligned actor that targets think tanks in the US and Japan relays Microsoft's real sign-in through a fake browser window. What stops it, who acts, and how to hunt for it.Fri, 02 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/divd-zammad-boundaries/https://secopsnomad.si/blog/divd-zammad-boundaries/A support platform can connect sensitive conversations, privileged workflows, and the rest of the environment.Thu, 01 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/dmdc-data-exposure/https://secopsnomad.si/blog/dmdc-data-exposure/A long reported exposure window shifts the review toward retention, historical evidence, data ownership, and targeted impersonation.Thu, 01 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/jaea-cloud-files/https://secopsnomad.si/blog/jaea-cloud-files/JAEA’s cloud-service disclosure highlights sensitive uploads, supplier evidence, and the limits of an endpoint-only investigation.Thu, 01 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/metamask-validator-incident/https://secopsnomad.si/blog/metamask-validator-incident/What an infrastructure incident means for service owners, key custody, partner assurance, and follow-on impersonation.Thu, 01 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/netscaler-post-exploitation/https://secopsnomad.si/blog/netscaler-post-exploitation/New post-exploitation reporting offers leads for appliance logs, configuration exposure, and privileged changes.Thu, 01 Oct 2026 00:00:00 GMThttps://secopsnomad.si/blog/zimbra-mail-server-hunt/https://secopsnomad.si/blog/zimbra-mail-server-hunt/Microsoft’s exploitation report connects a mail-server weakness to host activity and published network indicators.Thu, 01 Oct 2026 00:00:00 GMT