[Contained][Severity: Moderate][Ransomware]

Ishinomaki Area Wide Administration Union: a server on its internal network was infected with ransomware and part of its work was disrupted

Data on a server was encrypted overnight on February 24 and 25 and noticed on the 27th. Part of its work was disrupted but continues using backups.

Disclosed

2023-03-09

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2023-02-24
From late at night into the next day, data on a server of the secretariat's internal network was encrypted. [1]
2023-02-27
In the morning a staff member noticed the data anomaly. The maintenance contractor examined the server and found a ransomware infection. [1]
2023-02-28
It reported the damage to the Ishinomaki police station. A virus scan of all PCs on the internal network found no anomaly. [1]
2023-03-02
Provisional restoration of the server from backup data was completed. [1]
2023-03-09
It announced the case. [2]

Impact

Part of the work of the General Affairs and Planning Division, the Facilities Management Division, the Nursing Care Certification Review Division and the Ishinomaki Wide-area Clean Center was disrupted, but work continues using backup data. The server held data on past and present review committee members and project participants (name, birth date, address, phone number and others). No trace of the data being taken has been found, and no leak has been confirmed. The infection route could not be identified from the server logs. [1]