Yamada Corporation: ransomware through its VPN encrypted internal servers and stopped core systems for about three months, and applicant and shareholder data may have leaked

1. 2025-06-23

   At night, an unauthorized access abusing a VPN connection breached internal servers and some PCs, and ransomware was run. [2]

2. 2025-06-24

   It began investigating a malfunction in its internal systems, confirmed the unauthorized access and isolated the PCs and servers from the network. [1] [2]

3. 2025-06-26

   It announced the incident in a timely disclosure. [1] [4]

4. 2025-07-01

   It mostly resumed work using methods that did not rely on the core system. [3]

5. 2025-07-16

   It announced that personal data may have leaked. [2]

6. 2025-09-01

   The core system setup was completed again. [3]

7. 2025-10-01

   It started normal operation of the core system and, by October 14, had mostly resumed the other main systems. [3]

It could not rule out a leak from the encrypted data containing personal information. The people covered are applicants for new-graduate hiring from the class of 2014 to the planned class of 2026 and for mid-career hiring, shareholders at any point from end of September 2017 to end of March 2025, and people who exchanged business cards at exhibitions from April 2008 to June 2023. No count was published. It kept production and shipping going by hand. [2] [5]

No leak or misuse of the information had been confirmed as of October 17. [3]