Fujikura: attackers entered through a VPN device managed by its maintenance contractor, and data with personal information left Sakura plant servers

1. 2024-07-02

   It found that its network had been accessed from outside through the maintenance and monitoring VPN device managed by its contractor NTT Communications. It disabled the abused account, reset all account passwords and replaced network equipment. [1] [2]

2. 2024-07-19

   It began a forensic investigation with the contractor and an outside security vendor. The investigation confirmed traces of outside access and data exfiltration on several servers at its Sakura plant. [1]

3. 2024-12-25

   It announced the case, saying the data that left was only part of what the servers held, but that some servers stored personal information, so a leak could not be ruled out. [1] [2]

The data at risk is mainly names, addresses, phone numbers, email addresses, birth dates and genders of partner employees, university staff, and employees, former employees and family members of Fujikura and its group companies. Some HR data, invoice numbers and bank account numbers are also included. No credit card data or My Number was found, and production was not affected. The number of people was not published. [1]