Toshiba Tec: five subsidiaries in four European countries were hit by ransomware at the same time, causing system failures, and data may have been stolen
Five subsidiaries in France, Belgium, Germany and the Netherlands were infected with ransomware late on May 4 and received ransom demands.
Disclosed
2021-05-17
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
Late at night local time, five companies, two subsidiaries in France handling multifunction printers and toner and affiliated subsidiaries in Belgium, Germany and the Netherlands selling POS systems, came under cyber attack. Ransomware caused system failures at each of them, and ransom demands arrived by email. [1]
It gave an update on its investigation. No information leaked at the German and Dutch subsidiaries. At the Belgian subsidiary information leaked, but not customer information. At the two French companies, access to servers was confirmed and the leaked information is being examined. [2] [3]
Investigation
Five companies were hit, but not through a shared system: separate systems at each company were attacked within a few hours. Toshiba Tec said it was investigating the cause and the extent of any data leak with an outside security firm, including the possibility that malware spread among the subsidiaries. It said data might have been stolen. [1]
Timeline
- Started, Detected 2021-05-04
- Disclosed 2021-05-17
- 13 days
Attack or cause
- Method
- [Ransomware]
- Impact
- [Service outage][Extortion]
- Entry point
- Unknown
Data exposed or at risk
–
Organizations involved
[Breached][Major]Tokyo, ShinagawaManufacturing
Toshiba Tec CorporationFive of its European subsidiaries were hit.
Sources
- [1][News]欧州5拠点で同時多発的なランサム被害 - 東芝テックSecurity NEXT · 2021-05-17
- [2][News]欧州子会社5社のランサム被害、2社では情報流出なし - 東芝テックSecurity NEXT · 2021-06-11
- [3][News]東芝テックグループの欧州子会社へのサイバー攻撃、フランス、ベルギーの2カ国3現地法人からの情報流出が判明ScanNetSecurity · 2021-06-16 08:00