Nihonsakari: its server was accessed without authorization, internal systems failed, its ordering system became unusable and the online shop was closed

1. 2022-09-16

   At about 21:00 the first intrusion came through a vulnerability of an SSL-VPN device. [3]

2. 2022-09-18

   It confirmed that its server had been accessed by a third party and internal systems had failed, and cut the server from the network the same day. [1] [2]

3. 2022-09-19

   It reported to the authorities concerned. [1]

4. 2022-09-20

   It announced the case and closed the online shop. Whether personal data leaked is unknown, and it is investigating with outside specialists. [1] [2]

5. 2022-10-25

   It published the investigation results. It was a ransomware attack and the data had been encrypted. [3]

Systems including the product order system became unusable. It set up a consultation desk for consumers of its mail-order business. [1] [2]

The investigation found an intrusion through a vulnerability of the SSL-VPN device, with the server data encrypted. Whether personal data leaked could not be determined even after investigation. As measures it stopped using the VPN and introduced EDR and MDR. Mail-order shipping is resuming in order and the rebuilding of the new order system continues. [3]