Toshiba Tec: unauthorized access to a cloud service it uses, and personal data of partners and staff may have been viewed

1. 2024-03-20

   It noticed suspicious behaviour in a cloud service it uses and reported to the Personal Information Protection Commission. It asked a specialist investigation firm and lawyers to investigate. [1]

2. 2024-04-05

   It announced the case. It said it had identified the route of entry and acted to prevent new attacks. No secondary harm was confirmed. [1] [3]

3. 2025-04-04

   It published a follow-up for people it could not reach, and stated the people affected more specifically. [2]

The first announcement said names, email addresses, company names, department names, job titles and the contents of emails and other documents of partners and some employees of the company and group companies (including contractors) may have been viewed. The number of people was not stated. [1]

The follow-up said former employees who left between April 1, 2018 and March 20, 2024 are covered: names, birth dates, hire dates, education, email addresses, departments, job titles and qualifications, and for those posted abroad, management data such as passport numbers. Business card data collected at a 2018 exhibition is also included. [2]