Definition
The act (in force since 2000) defines "unauthorized access" as entering another person's identification code — an ID, password, or biometric — into an access-controlled system without permission, or bypassing access control by exploiting its weaknesses. A 2012 amendment added obtaining or storing another person's identification code illegitimately, and setting up phishing sites.
Attacks on web systems used to center on stealing credit card data from e-commerce sites. More recently, consumers' names, addresses, and contact details held by membership services and booking systems have become the target. Macnica's tally (published October 7, 2026, in Japanese) counts 265 publicly disclosed leaks of personal data from Japanese companies' web systems between January 2024 and October 6, 2026 — 81 of them disclosed since July 2026.
The same article sorts the entry points into web systems, in general terms, into three groups: vulnerabilities in shared software such as CMSs and frameworks; misuse of credentials obtained by guessing or phishing; and site-specific misconfiguration such as API permissions and session management. For 80% of the 81 cases since July, though, the disclosures don't say enough to tell the cause. The author suggests the stolen data may be used to make phishing emails and impersonation scams more believable. Intrusion can't be prevented completely, so the size of the damage comes down to one question: when someone got in, what could they carry out, and how much of it?
Lemma implementation
Lemma is not an intrusion-detection product. What it does is build a structure where raw data isn't sitting where the intruder lands. If identity, age, or qualification checks receive only the needed attributes as selective disclosure proofs instead of storing the raw data, all that remains on the server is a docHash and a commitment.
For operations an AI agent performs, authority can be proven separately from knowing an ID and password. Trust402 has the agent prove, with a zero-knowledge proof, that it holds the role and spending limit for a payment, and stops requests whose proofs fail before execution. The same check can sit in front of other operations routed through Lemma.
It also prepares for the explanation afterwards. Reads made through Lemma leave a tamper-evident audit trail of who read which data, and when. In breach reports and notifications to affected individuals, what was read through that path can at least be shown as fact.