Tekken: ransomware encrypted over 90% of its servers, and stolen data appeared on an outside site

1. 2020-09-23

   At about 7:00, a system failure was detected. All employee PCs were cut off from the internal network, and an English ransom note with contact details but no amount was found on affected servers. [1] [2]

2. 2020-09-30

   Core business servers were restored. [1]

3. 2020-10-04

   File servers were restored. [1]

4. 2020-10-09

   The company published the status of the failure and recovery. [2]

95% of the company's 70-odd servers were encrypted or otherwise damaged. Security software had been uninstalled from about 10% of the roughly 3,000 employee PCs. [1]

Some data was taken from the servers and posted on an outside site. The company said all of it was public information, not confidential. The mail server was badly damaged, and a stand-in system was set up until it could be restored. [1]

The company decided not to contact the attackers at all and consulted the police. With three outside firms it investigated the entry point and extent of damage, and rebuilt from backups while cleaning out malware. It did not name the ransomware, saying it was not yet confirmed. [1]