Okano Valve: ransomware infected three of its 13 servers, including the file and mail servers, and the attackers demanded money

1. 2021-04-22 14:00

   Around this time, three servers were logged on to without authorization through remote desktop connections. From late that night to the next morning, ransomware was run on two of them and files were encrypted. [3]

2. 2021-04-23 08:00

   Around this time, the company noticed a failure in the systems the group uses. It cut its internal terminals and other devices off from the network and found that ransomware was the cause. [1]

3. 2021-04-26

   The company announced the case. Three of its 13 servers were infected with ransomware. [1] [2]

4. 2021-06-17

   It published the results of an outside firm's investigation. No ransomware sample was found, so the type is unknown, and the attack may have been fileless. [3] [4]

Three of the 13 servers, including the file server with the business systems and the mail server, were infected with ransomware. The attackers demanded money in exchange for lifting the failure, but they did not claim to have stolen information. [1]

As of April 27, no leak of personal or confidential information and no effect on production equipment had been confirmed. The company had backups, but it checked whether some information had been lost. It restored data that affects customers first, such as production data, and said that full recovery would take time, mainly because the mail server was hit hard. [1]