Capcom: a Ragnar Locker ransomware attack encrypted internal systems and leaked personal data of 15,649 people

1. 2020-11-01 23:00

   Around this time, some machines at sites in the US and Japan were infected with ransomware, and their files began to be encrypted. [5]

2. 2020-11-02

   From early morning, mail, file servers and other systems became hard to reach. The company cut off its systems, found a ransom note from a group calling itself Ragnar Locker on affected machines, and reported it to the Osaka police. [3] [5]

3. 2020-11-03

   The company began contacting investigators and data protection authorities in the countries concerned. [5]

4. 2020-11-04

   The company announced the system failure and said game play was not affected. [1] [2]

5. 2020-11-12

   The company confirmed that 9 records on former and current employees, as well as sales reports and financial data, had leaked. [3]

6. 2020-11-16

   The company said the attack used ransomware and that up to about 350,000 personal records may have leaked. [3] [4]

7. 2021-01-12

   It published a third report. Newly confirmed leaks covered 16,406 people, bringing the total to 16,415. It put the personal data of outside people that may have leaked at up to about 390,000 (up about 40,000), adding about 58,000 job applicants. [7] [8]

8. 2021-04-13

   The company published the findings of outside investigators. The total number of people whose data was confirmed leaked came to 15,649. [5] [6]

As of November 16, the confirmed leak covered 5 former employees (names with signatures, a name with an address, and passport details) and 4 employees (names with HR data or signatures). Business data such as sales figures, supplier data, sales materials and development documents may also have leaked. [3]

Online payments were handled by outside firms, so the company held no card data and none leaked. [3]

The third report of January 12 newly confirmed leaks of 3,248 business contacts, 9,164 former employees and others, and 3,994 employees and others, as well as sales figures, sales materials, development documents and supplier data. About 18,000 North American records, such as Capcom Store members, were removed from the total because a recheck found no sign they had leaked. The April 13 report put the confirmed total at 15,649 people. [5] [7] [8]

In October 2020, a single old VPN device kept as a spare at the US subsidiary Capcom U.S.A. was attacked and used to get into the internal network. It had been kept for emergencies as COVID-19 increased network load. Machines in the US and Japan were then taken over and data stolen. The device has since been disposed of. [5] [6]

The note asked the company to make contact to negotiate but gave no amount. After consulting the police, the company did not negotiate and made no contact at all. [5]

All machines suspected of compromise were cleaned, and the company brought in a SOC service that watches outside connections around the clock and EDR to watch device behavior. It set up a security office in December 2020 and, in January 2021, a security oversight committee that includes outside experts. [5]