Panasonic: its file server was accessed without authorization and some data was read

1. 2021-11-11

   It confirmed the unauthorized access. [1]

2. 2021-11-26

   It announced the case. It found that some data on the file server had been read and was checking whether personal data or social-infrastructure information was included. [1] [2]

3. 2022-01-07

   It published a second report. It found that attackers had entered the file server in Japan through a server of an overseas subsidiary. [3] [4]

4. 2022-05-12

   The Smart Energy Systems division of Electric Works issued a follow-up and confirmed that the file server which was accessed held personal data of internship applicants. [5]

5. 2022-05-30

   The technology division of Panasonic Holdings announced that the same file server held personal data of applicants to that division. No proof of leakage was found, but assuming a possible leak it is contacting those affected individually. [6]

Some data on the file server was read. ITmedia reported that technical information, business-partner information and employees' personal data might be included, and that unauthorized access using stolen credentials was suspected. At the time of the announcement the data involved and the cause were still under investigation. [1] [2]

The investigation found that a third party entered the file server in Japan through a server of an overseas subsidiary, and no unauthorized access to other business systems was found. It found no fact that proves the files left the company, but it responded on the assumption that they might have. The server held no personal data of general consumers. It held personal data of job applicants and internship participants managed by some business units (several hundred people in total, according to Nikkei), business contact details of staff of partner firms, and files of business and internal information provided by partners. [3] [4]

The investigation found that the file server which was accessed held personal data provided when applying for internships or to the technology division. No proof of leakage was found, but those affected are being contacted on the assumption that data may have leaked. No secondary damage was reported. [5] [6]