Nichirin: the server of its US subsidiary was infected with ransomware and its production management system stopped

1. 2022-06-14

   The subsidiary's server was infected with ransomware through unauthorized access from outside. It cut off the network and confirmed that group companies in Japan and abroad had no similar infection. [1]

2. 2022-06-22

   It announced the case. The production management system stopped, and production and shipping by hand keep delivery disruption low. Investigating the cause and any leak is expected to take time. The company website also became briefly unreachable, though a link to this case is unknown. [1]

3. 2022-08-12

   It published a second report. The attacker was found to have entered through a weakness in the remote-connection settings. [2] [3]

The attacker obtained administrator credentials, entered one server, installed reconnaissance and remote-access tools, and spread ransomware across the network on June 14 (local time). The website outage was caused by a concentration of traffic and may be related. The ransom note named no amount, and the company did not contact the attacker. [2] [3]

No exfiltration has been confirmed. The files include business contact details of partners and information entrusted by partners. [2]