Sports Club NAS: two servers in its data center had all data encrypted by ransomware, disrupting its member management system, and a message demanding the purchase of a decryption tool was left

1. 2021-04-02 02:00

   Around this time, all data on two servers run in a data center was encrypted. A message demanding the purchase of a decryption tool was left on the servers. [1] [2]

2. 2021-04-02 08:55

   The failure was noticed. [1]

3. 2021-04-14

   It reported to the Personal Information Protection Commission. [1]

4. 2021-06-04

   It reported the damage to the police. [1]

5. 2021-06-15

   It made an additional report to the Personal Information Protection Commission. [1]

6. 2021-06-16

   It announced the case. [1] [2]

7. 2021-11-25

   It published the result of an investigation by a specialist firm. [3]

The servers held data of 150,084 members, including 34,920 whose cards had expired, and 460 employees. The member management systems of nine stores were disrupted. According to reports, the intruder got in after an encrypted key was identified. The company sees it as an indiscriminate ransomware attack, and the attacker made no claim of having stolen data. [1] [2]

The investigation found that, although a firewall was set on the server, a third party somehow identified an encrypted key used for external access on April 2 and gained access, infecting the server with ransomware. All data on the server was encrypted and the member management system of nine clubs became unusable. Verification confirmed that no data leaked. [3]