EXD: ransomware encrypts data on participants of Fukushima Prefecture and Koriyama City events

On 3 December 2024 EXD (Sendai), an event planning company, disclosed unauthorized access to its servers and a ransomware attack. It found data encrypted on 28 November, and an intrusion likely took place early on 27 November. The server held data on participants of events that group company Exceed Connect handled as a subcontractor. Koriyama City said 1,513 applicants for Out of KidZania in Koriyama 2024 (names, gender, school year, guardian names, addresses, phone numbers and email addresses) were affected, and Fukushima Prefecture said about 5,000 records from five events including Fukushima Festa were. According to the Asahi Shimbun, the company was asked for a ransom and did not pay. Its final report on 8 January 2025 said it was very unlikely that data had been taken out in bulk. The final report also lists business contacts, employee/family data including bank details, payroll and My Number, and sole traders' bank details, remuneration and My Number.