Takamiya: attackers got into internal servers through its Vietnam base and infected them with LockBit, and customer data and the data of all group employees may have leaked

1. 2022-12-08

   It found that this was the day of the attack. [4]

2. 2022-12-15

   The business systems suffered access failures. A check found that files on internal servers were encrypted and infected with the LockBit ransomware. It set up a response headquarters. [1] [2]

3. 2022-12-16

   It saw that a minimum set of business systems could be restored and began recovery. It asked outside lawyers and a security firm for support. [1]

4. 2022-12-19

   It sent a preliminary report to the Personal Information Protection Commission, and a report for the subsidiaries on December 23. [1]

5. 2023-01-07

   It received an email from someone claiming to have carried out the ransomware attack and confirmed that its name was on the attacker's leak site. [1] [2]

6. 2023-01-11

   It met the Osaka prefectural police to discuss the investigation and received the initial report of the forensic investigation. [1]

7. 2023-01-23

   It announced the case. [1] [3]

8. 2023-01-26

   The forensic investigation finished. A dark web survey found no sign that data had appeared anywhere other than the LockBit leak site. [4]

9. 2023-02-10

   It published a second report. The cause was a vulnerability in the security system of the Vietnam base together with insufficient monitoring. [4] [5]

The initial investigation suggests the attacker accessed the Vietnam base without authorization, got into the internal servers and ran the ransomware. The data that may have leaked is customer information held on the internal servers (including personal data) and employee data of all group companies. The number is under investigation. Three of the nine group companies held no personal data on the attacked servers. [1] [2]

The data that may have leaked is consumers' names and addresses, information on partner staff (including health check results, copies of driver's licenses and parts of health insurance and pension numbers), information on retirees (including My Number and the My Number of family members), job applicants and shareholders. [4] [5]