MK SYSTEM: servers in its data center were encrypted by ransomware and services such as "Sharomu" for labor consultants stopped for about 3,400 users

1. 2023-06-05

   At about 06:00 it found that servers in the data center were down. At about 07:00 infrastructure staff checked on site, found a warning message that looked like ransomware and cut the related internet lines. With outside experts it concluded that a third party had gained access with ransomware. All the servers serving the "Sharomu" system were encrypted and did not work. It set up a response headquarters and began sending fault information emails to users. [1] [4]

2. 2023-06-06

   It reported to the Osaka prefectural police and was questioned. It made a timely disclosure titled notice of ransomware damage by a third party. [1] [5]

3. 2023-06-08

   It reported to the Personal Information Protection Commission. [1]

4. 2023-06-09

   It published the status of its response. For offices that urgently needed payroll, it adapted the web version of "Net de Chingin", then under development on AWS, and offered it as a provisional version to about 2,800 labor consultant offices. [1] [4]

5. 2023-06-16

   It began taking applications for the on-premises version of "Sharomu". By June 19 there were about 2,300 applications, of which about 1,400 had been delivered. [1] [4]

6. 2023-06-21

   It published a second report. Nine services are affected. Full recovery is expected between the end of June and early July. [1] [4] [8]

7. 2023-06-30

   It began restoring some services on a new environment built on AWS. More services were restored in turn on July 7 and 11. [9]

8. 2023-07-19

   It published a third report. The forensic investigation by an outside expert ended. Because the case was a ransomware compromise, it cannot fully rule out that some data was stolen, but no trace of data theft or transfer to outside was found, and no posting on the dark web was confirmed. My Number data is strongly encrypted and is outside the range at risk of leaking. It will not publish the details of the findings for security reasons. It filed a final report with the Personal Information Protection Commission. [9] [10]

9. 2023-09-07

   Sofmap announced that, because of the ransomware damage to the servers of "Sharomu" and other services used by its outsourced labor and social security attorney corporation, it cannot completely rule out that personal data of people formerly employed by it also leaked. [11]

10. 2024-03-25

    The Personal Information Protection Commission announced administrative action (guidance) against MK System. [12]

Nine services were affected: Sharomu V5.0, Sharomu V3.4, SR-SaaS, Sharomu Company Edition, Net de Komon, MYNABOX, MYNABOX CL, Net de Jimukumiai and DirectHR. Most of its about 3,400 users could not receive the services normally, and it stops billing the affected users for June. No trace of personal data being sent out had been found in the investigation up to June 18, but the final report is not yet out. [1] [4]

STORES, Inc. announced that names, addresses, phone numbers, salary and bonus amounts, My Number (of the person and family), birth dates, basic pension numbers and others of people formerly employed by it (employees, part-timers, contract staff and others) may have leaked from the system of its outsourced labor consultant. Yomiuri Telecasting announced that names, addresses, sexes, birth dates, wage data and others of people who registered as part-timers from January 2018 to June 2023 may have leaked. In neither case has a leak been confirmed. [2] [3] [6] [7]