Yokohama Toyopet: Emotet infected 12 PCs, leaking contacts and mail text and sending floods of spoofed mail

1. 2020-07-28

   One PC on the office network opened mail with a Word attachment and was infected with Emotet. Large volumes of suspicious mail went to unrelated addresses. [2]

2. 2020-07-29

   Emotet mail reached many PCs and was opened on 11, spreading the infection. Spoofed mail quoting past messages was sent in bulk from outside servers. The same day the company posted a warning on its website and set up a response team with outside experts. [1] [2]

3. 2020-08-05

   A quick check showed Emotet was the cause, with 11 PCs at 11 of the 78 sites infected. A detailed investigation was ordered from specialists. [1] [2]

4. 2020-11-14

   The company published the results of the detailed investigation. [2]

In the end 12 PCs were found infected. Names and email addresses of correspondents and mail text kept in their mail software leaked. The malware had erased its traces, so the number of records is unknown. These PCs did not handle card or bank account data. [2]

Suspect PCs were disconnected and wiped, automatic Word and Excel macros were turned off, the mail service was moved to a safer setup, and all staff received security training. [2]