Ishimitsu: ransomware, starting with remote desktop access to a group company's SIM-equipped laptop

On 20 September 2024 the food trading company Ishimitsu (TSE Standard 2750) disclosed a ransomware attack that encrypted some servers of the company and its domestic group companies. On 18 September it found files encrypted and inaccessible. Its findings of 1 November said the attackers first accessed a group company's SIM card-equipped laptop through a remote desktop connection, then got into servers of the company and its domestic group companies and encrypted data. There were traces of some or all of the data being transferred out, but the accessed scope could be identified and contained no personal data, and a dark web search found no leaked data. Personal data destroyed by the encryption with no separate copy includes employees' and dependants' My Number data (21 records at the company, 13 at subsidiary US Foods), job applicants' CVs and up to 100 customers' bank account details submitted for refunds.