Nihon Hifuku Kogyo: past emails leaked and suspicious emails impersonating its staff were sent

1. 2021-10-06

   It received a spoofed email reusing the content of a past email sent from its PCs, and customers had received the same. It asked its network management contractor to find the cause. [1] [2]

2. 2021-10-07

   The contractor pointed out a possible infection with the malware Emotet. It checked all 31 in-house PCs with a Trend Micro tool and JPCERT/CC's EmoCheck, but found no infection. [1] [2]

3. 2021-12-22

   It announced the case. [1] [2]

It judged the cause to be intrusion into the mail management account rather than a virus infection, and changed the passwords. What leaked was the email addresses and names of past correspondents and the subjects and bodies of emails; no other personal data leak has been confirmed. No new leak has been confirmed since the password change. It took measures such as installing UTM devices at its sites. [1]