Mitsubishi Heavy Industries: a laptop infected through social media while working from home let attackers into the Nagoya network and leak staff data

1. 2020-04-29

   An employee working from home connected straight to an outside network, downloaded a malware-laden file sent over social media, and infected the work laptop. [3] [4]

2. 2020-05-07

   The employee came to the office and connected the laptop to the company network. [4]

3. 2020-05-18

   The infection spread through the company network. [4]

4. 2020-05-21

   Improper outbound traffic from a server in the Nagoya area was detected and an investigation began. [1] [4]

5. 2020-05-22

   The breached devices were identified and cut off from the network. [1] [4]

6. 2020-08-07

   Public disclosure. [1] [2]

Group employees' names, email addresses and other personal data leaked, along with network packets, server logs and settings. The company said no sensitive information, confidential technology or important customer data leaked. [1] [3]

The company said the cause was that work laptops could connect to outside networks without going through the company network. It blocked direct outside connections and stepped up monitoring. [2] [4]