FUJIFILM: its domestic network was infected with ransomware and servers and PCs were shut down, which disrupted inquiry desks, orders and shipments for about two weeks. No trace of data leaving the company was found

1. 2021-06-01

   In the evening, a message on a PC suggesting a ransomware infection revealed the unauthorized access from outside. [1] [3]

2. 2021-06-02

   It stopped all servers and PCs that might be affected and cut off the network. It set up a special response team including outside experts and made its first announcement at 12:00. It could not answer inquiries by phone and email, and deliveries by related companies were also affected. The online print service FUJIFILM Print & Gift and the online shopping site FUJIFILM Mall still took orders but gave no support, and delivery dates slipped. Services that run entirely in the cloud, such as the photo organizing app PhotoBank, were not affected. It reported to the Ministry of Economy, Trade and Industry and other authorities and consulted the police. [1] [3] [6]

3. 2021-06-04

   It examined the malware sample and concluded it was ransomware. The infection was limited to a specific domestic network. The company said it had not complied with and would not comply with ransom demands. It restarted servers and PCs confirmed safe and brought the network connections it had cut back one by one. For the infected network it aimed to finish recovery within the week of June 7. [1] [4] [6]

4. 2021-06-14

   Normal business toward customers and partners, including the inquiry desk and product orders and shipments, was restored. The investigations finished so far found no trace of information leaving the company. [2] [7]

5. 2021-06-25

   Delivery delays were cleared. [5]

6. 2021-06-28

   It finished the forensic investigation of the servers and the examination of the malware sample, found no trace of information leaving the company and concluded that nothing had leaked. [5]

Shutting down servers and PCs and cutting the network disrupted inquiry handling, orders and shipments for about two weeks. The damage from the ransomware itself was limited to a specific domestic network. No information leaked, so the harm was limited to the interruption of business. [2] [5]