> JapanHacked_
[Resolved][Severity: Moderate][Ransomware]

Rintatsu: its server was accessed without authorization, and it stopped PCs and the network because of a ransomware risk

Encryption by ransomware was confirmed, but no trace of a leak was found; normal operations resumed on March 8.

Disclosed

2022-01-27

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. In the early morning it recognized suspected unauthorized access to its server from outside. It set up a special response team with outside experts, stopped the affected servers and PCs and cut the network. It reported to the police. [1]

  2. It confirmed a ransomware risk, and that the effect was limited to certain servers. [1]

  3. It announced the case. It is restarting servers and PCs that have been confirmed safe and resuming communication in turn. [1]

  4. It announced that servers were restored and normal operations resumed. It confirmed encryption by ransomware but found no trace of a leak. [2]

Timeline

  1. Detected 2022-01-25
  2. Disclosed 2022-01-27
  3. 2 days

Attack or cause

Method
[Ransomware]
Impact
[Service outage]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社サーバーへの不正アクセスについてRintatsu Co., Ltd. · 2022-01-27
  2. [2][Official]弊社サーバーの復旧についてRintatsu Co., Ltd. · 2022-03-08