[Investigating][Severity: Moderate][Ransomware]

Nippon Concrete Industries: its servers were infected with ransomware and business data and business software were encrypted

Its servers were accessed late on May 5 and files were encrypted. Business data and software are unusable, and whether data leaked is under investigation.

Disclosed

2023-05-09

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2023-05-05
It was accessed from outside late at night. [1] [2]
2023-05-06
It confirmed that files stored on the servers were encrypted. [1] [2]
2023-05-07
From the next morning it investigated with outside experts, identified the type of ransomware and took steps to stop the infection spreading. [1]
2023-05-08
It set up a company-wide response headquarters and began consulting the police. [1]
2023-05-09
It announced the case. [1] [2]
2023-05-29
It announced that it had identified the entry route and the type of ransomware. PCs were not infected, and mail was resumed on a separate line. Core systems remain down, and no trace of a data leak has been found. [3] [4]
2023-07-07
It published the investigation results. A known vulnerability in the VPN function of a firewall was exploited, unauthorized access began on May 3 and intensified late on May 5. The attacker obtained the administrator password by brute force, logged in and spread the encryption. Of the 15 servers examined, 11 were encrypted and cannot be decrypted. There were signs of attempts to access 5 of 100 PCs, but none was infected. No trace of a large data outflow was found, and it judged that no information leaked. As full recovery of the current systems is difficult, it will move to the new system planned for April 2024. [5] [6]

Impact

Business data and business software stored on the servers were encrypted and became inaccessible. Whether information leaked is under investigation, and it is working on recovery by itself. The effect on results is being examined. [1] [2]