Tokyo Sonpo Kantei: ransomware puts customer data of several insurers at risk

On 7 October 2024 Tokyo Sonpo Kantei, which carries out loss adjustment for non-life insurers, announced that personal data may have leaked through unauthorized access. On 29 August it could not reach its internal servers and found they had been encrypted. On 2 September it found a message from the attackers threatening to publish the data on the dark web unless their demands were met; it has had no contact with them. According to its findings of 25 December, the attackers brute-forced a UTM device, entered servers over RDP and encrypted files and drives. No data transfer was found, but logs may have been deleted, so exfiltration cannot be ruled out. Besides its clients' customer data, records of 91 employees, 60 job candidates and about 6,400 business contacts were affected. Tokio Marine & Nichido said about 72,000 records of its customers may have leaked, Mitsui Sumitomo Insurance about 120,000, Sompo Japan about 38,000 and AIG General Insurance customers in 155 cases.