[Contained][Severity: Major][Intrusion][Malware]

Mitsubishi Electric: intruders used an unknown flaw in antivirus servers, personal data and business secrets at risk

Mitsubishi Electric said intruders in its network may have taken personal data of about 8,000 people and business secrets, later including defense information.

Disclosed

2020-01-20

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2019-03-18
An antivirus management server at a site in China was breached through a flaw that had no fix yet; its pattern update feature was abused to reach the site's computers. [3]
2019-04-03
Using computers in China, the attacker hit an antivirus management server in Japan the same way and spread to several sites in Japan. [3]
2019-06-28
Behavior detection in the antivirus software flagged suspicious activity on a computer in Japan. [1] [3]
2019-07-17
All malicious destinations were blocked and the company judged the attack contained. [3]
2020-01-20
The company disclosed the possible leak and began notifying the people affected. [1]
2020-02-10
A second report added that information the Ministry of Defense had marked for care may also have leaked; it was found on 7 February and reported to the ministry the same day. [2]

Impact

About 200 MB may have been sent out. Because the attacker erased logs on some computers, the company could not tell what actually left, so the counts are maxima. [1] [5]

Group	People
Job applicants	1,987
Head office employees (2012 survey results)	4,566
Retirees of group companies (pension fund data)	1,569

[1]

The business secrets were mostly internal papers such as technical documents, investment plans and order status. Sensitive information on power, rail and other infrastructure, and information protected by customer contracts, was not affected, the company said. [1] [3]

132 computers in Japan and abroad were suspected of infection, 9 of them in Japan holding personal or customer-related data. [3]

Cause

The attacker exploited an unpatched flaw in the antivirus system and ran fileless malware through PowerShell, using major cloud services as its platform to evade detection. [3]

Response

The company tightened network access between sites, put behavior detection on all computers and planned a security organization reporting to the president from April 2020. [3]