> JapanHacked_
[Investigating][Severity: Critical][Ransomware]

Nippn: its group network was widely encrypted by ransomware, core systems stopped, results announcement was postponed, and part of corporate and personal data may have leaked

Most group servers were encrypted in the early hours of July 7 and sales and accounting systems stopped. On August 16 it announced possible data leakage.

Disclosed

2021-07-09

Organizations involved

2

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From the early hours, most servers and some terminals in the group network run by its subsidiary Nippn Business System were encrypted at the same time. To contain the damage, all servers were stopped and internal and external networks were cut. [2]

  2. It announced the system failure. [2]

  3. It postponed its first-quarter consolidated results announcement for the fiscal year ending March 2022. [1]

  4. It announced that its investigation found part of the corporate and personal information managed on the servers may have leaked. OK Foods Industry announced the same on the same day. [2] [3]

  5. It announced the first-quarter results it had postponed, and said there would be no effect on performance from the second quarter on. [4]

  6. It applied for an extension of the deadline for the second-quarter report. [5]

Scope of damage

It reached the servers for Nippn's own core systems such as financial and sales management and its file servers, and also the sales management system used by 11 domestic group companies and the financial accounting system used by 26. The server managing backups was in the same state, the systems could not start, and no effective technical means for early recovery had been found. [2]

The subsidiary OK Foods Industry said the backup of its accounting system was intact, that it would restore it after confirming safety and resume closing work from mid-August. Its production and sales core system could not use the group server and would run on a temporary in-house server for now. [3]

Both companies applied to extend the filing deadline of the first-quarter report for the fiscal year ending March 2022 to November 15, 2021. [2] [3]

Timeline

  1. Started, Detected 2021-07-07
  2. Disclosed 2021-07-09
  3. 2 days

Attack or cause

Method
[Ransomware]
Impact
[Data leak][Service outage]
Entry point
Unknown

Data exposed or at risk

–

Supply chain

Organizations involved

Open in organization search

Sources

  1. [1][News]サイバー攻撃で東証一部上場企業が決算発表延期 ~ 製粉業ニップンScanNetSecurity · 2021-08-11 08:00
  2. [2][News]ニップンへのサイバー攻撃、グループ会社を含む基幹システムやデータサーバも暗号化被害にScanNetSecurity · 2021-08-19 08:00
  3. [3][News]ニップンへのサイバー攻撃、子会社オーケー食品のバックアップには被害なしScanNetSecurity · 2021-08-20 08:00
  4. [4][News]ニップンがサイバー攻撃で延期していた決算発表、第2四半期以降の業績に影響無しScanNetSecurity · 2021-11-05 08:05
  5. [5][News]ニップン、第2四半期報告書も提出期限延長を申請ScanNetSecurity · 2021-11-22 08:05