Hokuyaku Takeyama Holdings: ransomware via remote desktop with a domain admin ID

On 5 February 2024 Hokuyaku Takeyama Holdings disclosed a ransomware attack on its servers and other systems in the early hours of 3 February. According to its investigation results of 31 May, the attackers accessed a laptop with a SIM card through a remote desktop connection, then ran the Enmity ransomware on business servers and encrypted data. The ID and password used were legitimate domain administrator credentials; how they were obtained is still under investigation. The encrypted data has not been decrypted, but separately stored data lets the business continue. Forensic and dark web investigations found no trace of a leak, and the company concluded that no personal or other data leaked.