Settsu Metal Industry: it was infected with the Avaddon ransomware, damaging 14 servers and 11 PCs

1. 2021-05-10

   Around 08:00, the company found the attendance system server down. The head office joined the response at 10:00 and an expert at 16:00. [1] [2]

2. 2021-05-11

   It announced the case and began examining the damage to servers and the infection of PCs. [1]

3. 2021-06-11

   The attacking group stopped its activity and published decryption keys. [1]

4. 2021-06-14

   An outside firm finished analyzing the malware and found it was Avaddon. [1]

5. 2021-06-28

   It announced that the investigation was finished. The systems were almost fully restored. [1] [2]

14 of 18 servers and 11 of 185 PCs were infected. No ransom amount was shown, and there was no contact from the attackers and no payment. No leak was confirmed. The logs were also infected, so the route of entry is unknown. [1] [2]