Hanwa: apparent ransomware attack on its Thai subsidiary; group file server also accessed

Steel trader Hanwa announced on 20 September 2024 that servers and PCs of its consolidated Thai subsidiary HANWA THAILAND CO., LTD. had been accessed without authorization by a third party on 14 September. The attack appeared to involve ransomware; after finding it, the subsidiary reported to the local police and others and shut down and reinitialized the servers and PCs. Through this access, a file server used across the group, including Hanwa itself, was also accessed. No proof was found that files were taken out, but the server held business information provided by business partners and internal information, and the company said it would report to the affected partners individually.