Landbrain: its servers were infected with ransomware and data it held for more than 200 government bodies may have leaked; the investigation found no clear trace of a leak

1. 2021-02-23

   In the early hours, servers at Landbrain's Tokyo head office were infected with ransomware and data was encrypted. The company noticed the abnormality the same day. [1] [9] [11]

2. 2021-02-26

   It began reporting the infection to the local governments and government bodies that had commissioned work. [4] [6]

3. 2021-03-02

   It announced that information might have leaked, reported to the police and the Information-technology Promotion Agency, and began an investigation with outside specialists. [1] [2]

4. 2021-03-05

   Asahikawa City and Adachi Ward announced that their contractor's servers had been infected. [3] [5]

5. 2021-03-10

   Ibaraki City and Kishiwada City announced the case. [4]

6. 2021-03-22

   The Housing Policy Headquarters of the Tokyo Metropolitan Government announced the case. [6]

7. 2021-03-26

   Sumida Ward announced the case. [7]

8. 2021-04-01

   Landbrain said that personal data of more than 200 client local governments and central ministries it held might have leaked, and that it had actually received a demand for money. [8]

9. 2021-04-08

   The Ministry of Internal Affairs and Communications announced that information on three commissioned projects might have leaked. [9]

10. 2021-04-19

    Arakawa Ward announced that, based on the contractor's findings, it judged that no information had leaked. [10]

11. 2021-05-19

    Landbrain published the results of its investigation. [11]

12. 2021-06-04

    The Cabinet Secretariat's National Resilience Promotion Office announced that the specialist investigation had found no clear trace of an information leak. [12]

Landbrain takes on surveys and planning work for public projects from government bodies. Several servers at its Tokyo head office were hit, including the authentication, file and backup servers. The ransomware was Cring. [11]

The investigation found traces of some low-sensitivity files being opened but none of data collection, file transfer tools or external communication, and judged that nothing leaked. Arakawa Ward explained that the attacker passed the firewall (UTM) and opened two files, neither of which held the ward's data. [10] [11]

Each client announced the case before it was settled whether anything had leaked, so the table lists the data lent at the time of announcement, not the number of leaked records. [4] [9]