[Contained][Severity: Major][Ransomware][Intrusion]

Riken: its servers were hit by an attack that looked like ransomware, the network was cut off and ordering was disrupted

An apparent ransomware attack on July 17 came through a VPN device vulnerability. About 6,000 personal records and about 60 items of customer secrets leaked.

Disclosed

2022-07-19

Organizations involved

Leaked or at risk

6,000

Downtime

Unknown

What happened

2022-07-17
Late at night, it found that its servers had been accessed in a way that looked like ransomware. It cut the network off to stop the damage from spreading. [1]
2022-07-19
It announced the case. It said the damage was wide and returning to normal work would take time. It had reported to the police and other bodies and was working with them. [1]
2022-07-26
It published a second report. An investigation team including an outside lawyer was working out the extent of the damage. Ordering was disrupted but production was little affected, and no leak of personal data was confirmed. [2]
2022-08-30
A third report said it had confirmed that about 6,000 personal records and about 60 items of confidential customer information had leaked. [3]
2022-11-11
A fourth report gave the investigation results. The attacker exploited a vulnerability of a VPN device, stole authentication data, encrypted files on servers and PCs and stole some information. [4]

Impact

About 6,000 personal records and about 60 items of confidential customer information leaked. The personal data covers the names of some shareholders as of the end of March 2018 and for some their addresses and phone numbers; the names of employees and for some their department, address, phone number, birth date and face photo; and the names and company names of individual suppliers and for some their titles and contact details. The customer information covers company names and for some engine models and part quantities supplied. No misuse has been confirmed. Product manufacturing was not greatly affected, and recovery of the whole system will take some time. [3]

According to the specialist investigation firm, the entry route was a vulnerability of a VPN device, and the attacker got into the internal systems with some stolen authentication data. The internal servers and network are largely restored, and it strengthened or introduced a SOC that monitors external connections and EDR that detects suspicious behavior of devices early. No misuse of the personal data and confidential customer information has been confirmed, and manufacturing was not greatly affected. [4]