Hirokei: ransomware puts clients' medical data at risk

On 5 June 2024 Hirokei, which develops systems for health insurance societies, disclosed unauthorized access to its internal network. On 3 June it found it could not access data on its servers, which had been encrypted, along with a message demanding money. According to ScanNetSecurity, the attackers got in through a server vulnerability and a misconfigured VPN router, encrypted data on several servers with the Phobos ransomware, erased event logs and planted a backdoor. Its third report of 26 August said data may have leaked on contacts at business partners, sensitive data provided by clients (names, sex, birth dates, medical information, insurer numbers and insurance card numbers), shareholders, job applicants, and employees and their families (including some My Number records and health checkup results). According to Nikkei xTECH, seven health insurance societies announced from July to October 2024 that member data may have leaked, and personal data that should have been deleted had not been. According to the Kubota Health Insurance Society, Hirokei's server was infected on 8 April and the ransomware became active on 3 June. The Kubota, Sekisui, Kobe Steel and Daikin Industries societies, which used Hirokei through the Kansai Institute of Information Systems (KIIS), and the Chugoku Shinkin society, which contracted Hirokei directly, published the numbers affected; the largest was 86,936 people at the Kobe Steel society. Data of the Mitsubishi Heavy Industries society had reached Hirokei, which had no contract for it, because of poor data handling at a KIIS subcontractor.