Japan Airport Fueling Service: its servers were infected with ransomware, data was encrypted and payment in crypto assets was demanded, with no effect on aircraft fueling
Its servers were infected with ransomware, data was encrypted and payment in crypto assets was demanded. Fueling work was not affected.
Disclosed
2021-06-24
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
From the early morning, the internal network had a failure. An investigation found that servers had been infected with ransomware through unauthorized access and data was encrypted. [1] [2]
It announced the case. [2]
Impact and response
The attacker left a message demanding payment in crypto assets in exchange for recovering the data on the servers, with no mention of having stolen data. The company did not disclose the type of ransomware or whether the servers held personal or confidential information, saying it was under investigation. It reported to the competent authority and consulted the police. It denied any effect on fueling or related operations. [1] [2]
Timeline
- Detected 2021-06-21
- Disclosed 2021-06-24
- 3 days
Attack or cause
- Method
- [Ransomware]
- Impact
- [Extortion]
- Entry point
- Unknown
Data exposed or at risk
–
Organizations involved
[Breached][Moderate]Chiba, NaritaTransport and postal services
Japan Airport Fueling Service Co., Ltd.
Sources
- [1][News]日本空港給油でランサム感染被害 - 航空機給油業務に影響なしSecurity NEXT · 2021-06-30
- [2][News]日本空港給油にランサムウェア攻撃、社内サーバのデータを暗号化 暗号資産で身代金要求ScanNetSecurity · 2021-06-30 08:00