Nara Co-op: ransomware stopped its core systems and it suspended home deliveries for a long time

1. 2022-10-09

   In the early morning it was told that the network could not be reached, and found that security software had cut it off because of a cyberattack. Files on its core system servers were encrypted; it notified the police and set up a response headquarters. [1] [2]

2. 2022-10-13

   It filed a preliminary report with the Personal Information Protection Commission and announced a system trouble. It said recovery would take a considerable time. [1] [2]

3. 2022-10-14

   From this day it suspended home deliveries. [1] [2]

4. 2023-01-18

   It published a notice on personal data. No leak has been confirmed, but it said it could not fully rule one out. The entry was most likely through a vulnerability of a network device on the internet line. [3] [4]

5. 2023-01-23

   It began sending notices by postcard to the people concerned whose addresses it has. [3]

Home deliveries were suspended from October 14 to November 18. Stores stayed open, but with the network cut, payment was cash only and points could not be added or orders placed. [2]

The encrypted data included member information. The items whose leak cannot be ruled out are the member number, name, address, phone number, birth date, sex, purchase history and investment data, and for those who registered them, the email address and direct debit account data. It holds no credit card numbers. [3] [4]