Mitsubishi Electric: unauthorized access to a cloud service leaked bank account details of 8,635 domestic suppliers

1. 2020-11-16

   Monitoring of a cloud service picked up unusual access. [1] [2]

2. 2020-11-20

   The company announced that account data of 8,635 domestic suppliers had leaked. [1] [2]

3. 2020-11-30

   The starting point was traced to a subsidiary in China, and credentials for every group account were reset. [3]

4. 2020-12-11

   It emerged that part of the supplier account data and contact details of a subsidiary using the same cloud service had also leaked. [3]

5. 2021-03-26

   The company published the results of its investigation. [3]

The leak covered payment account data for 8,635 domestic suppliers, including supplier names, addresses, phone numbers, representatives' names, bank names, account numbers and account holders. [1] [2]

At the subsidiary Mitsubishi Electric Information Network, account data of 151 suppliers and 964 contact records also leaked. [3]

Staff credentials for the cloud service were stolen via the subsidiary in China and used to log in as legitimate users. No malware was used. [3]

The investigation found that the attack started at the subsidiary in China: account data for Office 365, used by it and by the subsidiary Mitsubishi Electric Information Network, was stolen and then used to attack Office 365 and related servers. The accounts that were accessed already had two-factor authentication. [4]