Kawasaki Heavy Industries: attackers reached servers in Japan through overseas sites, and data of unknown content may have been sent out

1. 2020-06-11

   An internal system audit found a connection from the Thailand site to servers in Japan that should not have occurred. The company judged it an intrusion the same day and cut communications between the site and Japan. [1] [5]

2. 2020-06-15

   It became clear that data may have been sent outside from the Thailand site. [1] [4]

3. 2020-06-16

   The company confirmed unauthorized access from the Thailand site to several servers in its data center in Japan. [1] [4]

4. 2020-06-24

   Unauthorized access from the Indonesia and Philippines sites to Japan was confirmed, and both sites were cut off from the domestic network. [1] [5]

5. 2020-07-08

   Suspected access from the US site to Japan came to light, and communications with that site were restricted. [1] [5]

6. 2020-08-03

   The company strictly restricted communications between all overseas sites and Japan. It began a detailed inspection of about 26,000 devices in Japan and Thailand and confirmed them clean by the end of October. [1] [4]

7. 2020-10-05

   It began inspecting about 3,000 devices at the compromised overseas sites other than Thailand and confirmed them clean by the end of November. [1] [5]

8. 2020-10-30

   Communication monitoring showed no intrusion into Japan since August. [1]

9. 2020-11-30

   The company restored the connections to the overseas sites it had cut. [1] [4]

10. 2020-12-21

    Monitoring after the restoration showed nothing abnormal in communications from those sites. [1]

11. 2020-12-28

    The company disclosed the case. [1] [2] [3]

12. 2021-07-30

    It published an investigation report. Malware checks of about 29,000 PCs and servers at sites in Japan and abroad, and forensic analysis of about 6,700 with heavy traffic, identified 36 servers that may have been accessed, 15 of which held suspicious encrypted files. Communication logs confirmed data sent from sites in Thailand, Indonesia and the US to suspicious servers on the internet. No leak of personal data was confirmed. [6]

The investigation found that information of unknown content may have leaked. The company said it had identified no fact of leakage from inside the company, personal data included, and contacted customers who might be affected individually. [1] [4]

The company said it handles personal data and social infrastructure information and that the method was a sophisticated one that leaves no traces. It apologized that the spread across several sites in Japan and abroad delayed the announcement. It set up a Cyber Security Group under the president on November 1, 2020. [1] [3]

It confirmed that information may have flowed out, identified the scope and type of the unauthorized access, and reported the results to customers whose information might have leaked. No concrete damage to customers or partners has been confirmed so far. It tightened control of communication between overseas and domestic sites, changed how data is exchanged and put measures against unauthorized access to its authentication infrastructure in place, and no new attack or damage has been confirmed. [6]