Sky Perfect JSAT: an attacker impersonating a subsidiary employee logged in to internal servers, and personal data of 1,451 partner contacts and staff may have leaked

1. 2023-06-01

   It found unusual access logs on the terminal server that subsidiaries use as a relay into its internal servers, and began an investigation. [1] [4]

2. 2023-06-08

   It cut the network thought to be the entry route and shut down the terminal server. No unauthorized access has been seen since. [2] [3]

3. 2023-06-14

   An outside expert investigation found traces of unauthorized access from the terminal server to internal file servers. [3]

4. 2023-07-21

   It announced the case. A malicious third party had impersonated a subsidiary employee and logged in to the internal servers through the subsidiary network. The accessed files were likely taken out. [1] [2] [4]

The data that may have leaked is for 76 business partner contacts (name, phone, email, affiliation, title and others) and 1,375 group employees, including former ones, and related people (name, phone, email, employee number and others). Subscriber data for services such as "SKY PerfecTV!" is not included, and no secondary damage has been reported. [1] [2] [4]