Yamaichi Shoji: an office PC was infected with what appears to be Emotet, its past mail history leaked, and mail posing as staff reached business partners
A PC at the Hida-Takayama food company was infected, and the mail history stored on it leaked. Mail posing as staff was then sent to those addresses.
Disclosed
2020-09-02
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
On September 2, mail using the company's addresses turned up inside the company and at business partners. An office PC had been infected with what appears to be Emotet, the past mail history stored on it had leaked, and mail claiming to be from staff was going to the addresses in it. [1] [2]
The mail posed as replies or forwards and carried Word or Excel attachments with random letter names, or links to outside sites. Because the mail kept changing, the company updated its description of the signs as it warned contacts. [1] [2]
Timeline
- Detected, Disclosed 2020-09-02
- 1 days
Attack or cause
- Method
- [Malware]
- Impact
- [Data leak]
- Entry point
Data exposed or at risk
Organizations involved
[Breached][Major]Gifu, TakayamaWholesale and retail trade
Yamaichi Shoji Co., Ltd.
Sources
- [1][Official]弊社メールアドレスを装うなりすましメールに関するお詫びとお知らせ。(更新)Yamaichi Shoji · 2020-09-02
- [2][News]社内パソコンがEmotet感染、取引先でも不審メールを確認(山一商事)ScanNetSecurity · 2020-09-18 08:00