> JapanHacked_
[Resolved][Severity: Moderate][Phishing]

Kumagai Gumi: a staff member followed an SMS posing as a courier, and the Apple Account of a company iPhone was taken over, possibly leaking 1,238 contacts

A staff member opened a link in an SMS posing as a courier and the Apple Account of a company iPhone was taken over. 1,238 contacts in iCloud may have leaked.

Disclosed

2025-07-04

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. At 14:00 an SMS posing as a courier reached a staff member's iPhone. A parcel was expected, so the staff member opened the link without suspicion and followed the instructions. The iPhone then became unusable and an investigation found unauthorized access to the Apple Account. [1]

  2. It announced the incident, finished reporting to the relevant government bodies and began informing the people identified. [1] [2]

Impact

The data that may have leaked is 1,238 entries of company name, name and phone number in the phone book synced to iCloud. No misuse of the information has been confirmed. [1] [2]

Timeline

  1. Started, Detected 2025-06-20
  2. Disclosed 2025-07-04
  3. 14 days

Attack or cause

Method
[Phishing]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Name][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][Official]個人情報漏えいの可能性についてKumagai Gumi Co., Ltd. · 2025-07-04
  2. [2][News]社有iPhoneスミッシング攻撃で1,238件の情報漏えい可能性│熊谷組Cybersecurity.com · 2025-07-14