NTT Communications: intruders came in through its Singapore base and may have taken work data on business customers

1. 2020-05-07

   The company found logs of an attempt to control an internal Active Directory server remotely and shut down the server used as a stepping stone. It also blocked traffic to outside sites that the malware talked to. [1] [3]

2. 2020-05-11

   Logs of the internal servers showed that some data may have leaked. [1]

3. 2020-05-13

   Files on the server that managed work records for the business cloud services were found to have possibly leaked. [1]

4. 2020-05-28

   Public disclosure. The intrusion began with an attack on the Singapore base and passed through old equipment awaiting removal after a migration. [1] [4]

5. 2020-07-02

   Second report: 83 more companies were affected by the work records, and stolen staff credentials had been used for remote access from a personal device into internal file servers, where data on 188 companies may have been seen. [2]

Work records for the Biz Hosting Enterprise service and Enterprise Cloud 1.0 options covering 621 business customers may have leaked, and the second report added 83. The internal files covered 188 companies. No data on consumer customers was included. [1] [2]

The company said it would protect equipment awaiting removal with current defenses and close unused network paths as customers left. It changed every employee's password, stopped remote access from personal devices and tightened authentication and monitoring. [1] [2]