[Resolved][Severity: Major][Malware]

Kameya Yoshinaga: a staff PC was infected with Emotet, customer data on the mail server leaked, and spoofed mail spread

A staff member of the Kyoto confectioner opened an invoice attachment that posed as a colleague. Names, addresses and phone numbers of customers kept in mail leaked.

Disclosed

2020-09-01

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-09-01
In the morning, an invoice mail claiming to come from a real employee reached another employee, who opened the attachment and enabled macros. Soon the shared office address was flooded with suspicious mail, and customers received mail quoting old conversations. The shop unplugged its PCs, warned people on its website, by phone and on social media, closed its online shop for the time being in the evening, and consulted the police. [1]
2020-09-02
Server settings were redone and mail passwords changed. [1]
2020-09-03
New damage came to light: one customer's data reached other customers, and stored mail reached companies the shop had never written to. All PCs were to be wiped or replaced. [1]
2020-09-11
The shop reported the results of its investigation. [2]

Impact

A security firm found that customer names, addresses, phone numbers, mail addresses and message text kept on the mail server had leaked. The shop said no card data leaked. [1]

News reports pointed to it as a small business publishing a detailed timeline from infection to response. [2]