> JapanHacked_
[Investigating][Severity: Critical][Ransomware]

GMB: its servers were accessed without authorization in what appears to be ransomware and it cut the network

What appears to be ransomware hit its servers as a whole and it cut the network. No leak or publication of information is confirmed.

Disclosed

2022-03-01

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. In the early hours it confirmed unauthorized access to its servers that appeared to be ransomware. [1] [2]

  2. It announced the case. It cut the network to stop the damage from spreading and reported to the police and others. [1] [2]

  3. It published the investigation result. Around February 27 an outside party exploited a network vulnerability to enter a server and encrypted files on several servers and PCs. There was no trace of leakage and no data was found on the dark web. [3] [4]

Impact

The attack damaged its servers as a whole, and it is identifying the affected files, investigating the cause and restoring systems in parallel. It expects it will take some time to return to routine operations. No leak or unauthorized publication of the stored information, nor similar damage at its overseas group sites, has been confirmed. [1]

Investigation result

Regular operations were affected for about a month, with some delays in orders, production and shipping. There was no trace of data leakage. [3]

Timeline

  1. Started, Detected 2022-02-27
  2. Disclosed 2022-03-01
  3. 2 days

Attack or cause

Method
[Ransomware]
Impact
[Service outage]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]当社サーバーへの不正アクセスに関するお知らせGMB Corporation · 2022-03-01
  2. [2][News]Japanese auto parts maker reports unauthorised access to serverReuters · 2022-03-01
  3. [3][Official]不正アクセスおよび情報流出の可能性に関する調査結果のお知らせGMB Corporation · 2022-05-20
  4. [4][News]自動車部品製造のGMBにランサムウェアとみられる不正アクセス、業績への影響は軽微ScanNetSecurity · 2022-05-25 08:05