Oriental Consultants group: ransomware hit several servers, encrypting much of its business data, which may have leaked; data entrusted by Ichikawa City and Saitama Prefecture was also stored there

1. 2021-08-15

   Several servers of the group, including Oriental Consultants Global, were attacked with ransomware. [1]

2. 2021-08-19

   A second ransomware attack followed. [1]

3. 2021-08-20

   Oriental Consultants Global announced the case. Ichikawa City also announced that its contractor's server was attacked. [1]

4. 2021-08-23

   Katsushika Ward announced the ransomware attack on its contractor Oriental Consultants. [3]

5. 2021-08-26

   Saitama Prefecture announced that servers of the group including its contractor Oriental Consultants were attacked. [2]

6. 2021-08-31

   Ichihara City announced the attack on its contractor Oriental Consultants. [8]

7. 2021-09-01

   The Tokyo Metropolitan Government announced the attack on its contractor Oriental Consultants. [4]

8. 2021-09-03

   Gunma and Shiga prefectures announced the attack on their contractors. Tokyo also announced further entrusted work beyond what it announced on September 1. [4]

9. 2021-09-17

   Kurashiki City announced the investigation status of the attack on its contractor. The holding company announced that it expects a special loss of about 750 million yen for the cost of investigation and recovery. [5] [6]

10. 2021-10-08

    The holding company published its investigation result. It could not rule out that part of the business data was sent outside, but could not confirm which data. [7] [9]

11. 2021-10-26

    Ichihara City published its investigation result. [8]

Much of the business-related data stored on the servers was encrypted and may have leaked. On the advice of outside experts, the servers were shut down and made inaccessible. [1]

As Saitama Prefecture's contractor, Oriental Consultants set up a response headquarters and is investigating toward recovery with outside experts, lawyers and the police. [2]

The holding company, Oriental Consultants Holdings, announced that it expects a special loss of about 750 million yen for the cost of investigation and recovery. Delivery was delayed on some projects, and its sales forecast was also lowered. [6]

The October 8 result confirmed that the group's information security measures were at the generally required level but that it was attacked through unauthorized access from outside. It could not rule out that part of the business data was sent outside, but could not confirm which data. No concrete leak, such as publication of business data on the internet, has been confirmed, and it continues to investigate and monitor. A damage report was filed with the police and accepted. [9]

Ichikawa City had entrusted two contracts to Oriental Consultants and one to Asano Taisei Kiso Engineering. The attacked server held survey data of parks, levee documents and a list of workshop participants for a tourism vision. The contract with Asano Taisei Kiso Engineering was newly signed and had no data. [1]

Saitama Prefecture had lent data for five jobs, including drawings of a drainage pumping station, survey and geological results for road and revetment design, and study information for the Omiya Super Ball Park concept. [2]

Katsushika Ward, the Tokyo Metropolitan Government, Gunma Prefecture and Shiga Prefecture also announced that servers holding data they had entrusted were attacked. Kurashiki City said registry information of landowners may have leaked. [3] [4] [5]

Ichihara City had entrusted support work for a base formation plan promotion project to Oriental Consultants' Chiba office from September 18, 2020 to March 25, 2022. [8]