Tomoe Shokai: ransomware via RDP; employee and other personal data at risk

Industrial gas trader Tomoe Shokai (Ota, Tokyo) and its group company Japan Gas disclosed on 16 May 2024 that they found a server fault on 10 May and, suspecting ransomware, shut down all systems and networks. Email and websites were also unavailable. Findings of 2 August said attackers got into the servers over a remote desktop (RDP) connection through an internet-facing firewall and ran ransomware; Japan Gas said an account used for RDP connections was misused. Systems and networks resumed on 1 August. On 3 August Tomoe Shokai announced that because servers including its HR system and the group's payroll systems had been accessed, a leak of data on 2,331 current and former employees, 248 employees of group companies (102 of them at Japan Gas) and 2 business partners of a group company could not be ruled out. The data includes names, birth dates, addresses, phone numbers, bank account details, some health check results and, for the 2 partners, My Number. No clear traces of data being taken were found.