> JapanHacked_
[Investigating][Severity: Major][Ransomware]

Toshiba Tec: five subsidiaries in four European countries were hit by ransomware at the same time, causing system failures, and data may have been stolen

Five subsidiaries in France, Belgium, Germany and the Netherlands were infected with ransomware late on May 4 and received ransom demands.

Disclosed

2021-05-17

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Late at night local time, five companies, two subsidiaries in France handling multifunction printers and toner and affiliated subsidiaries in Belgium, Germany and the Netherlands selling POS systems, came under cyber attack. Ransomware caused system failures at each of them, and ransom demands arrived by email. [1]

  2. It gave an update on its investigation. No information leaked at the German and Dutch subsidiaries. At the Belgian subsidiary information leaked, but not customer information. At the two French companies, access to servers was confirmed and the leaked information is being examined. [2] [3]

Investigation

Five companies were hit, but not through a shared system: separate systems at each company were attacked within a few hours. Toshiba Tec said it was investigating the cause and the extent of any data leak with an outside security firm, including the possibility that malware spread among the subsidiaries. It said data might have been stolen. [1]

Timeline

  1. Started, Detected 2021-05-04
  2. Disclosed 2021-05-17
  3. 13 days

Attack or cause

Method
[Ransomware]
Impact
[Service outage][Extortion]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]欧州5拠点で同時多発的なランサム被害 - 東芝テックSecurity NEXT · 2021-05-17
  2. [2][News]欧州子会社5社のランサム被害、2社では情報流出なし - 東芝テックSecurity NEXT · 2021-06-11
  3. [3][News]東芝テックグループの欧州子会社へのサイバー攻撃、フランス、ベルギーの2カ国3現地法人からの情報流出が判明ScanNetSecurity · 2021-06-16 08:00