Uniden Holdings: intruders entered through a flaw at its Australian base and over the VPN, and ransomware encrypted servers holding about 4,000 personal records

1. 2024-06-17

   Intruders entered through a security hole in a computer at the Australian base and compromised a VPN account on its network. [1]

2. 2024-08-28

   Ransomware spread to the Japan base over the VPN joining the two sites. It was run with a domain administrator account at both sites and encrypted most servers, including the backup system, and some computers (on the 28th and 29th). [1] [3]

3. 2024-08-29

   It detected the ransomware infection and cut the related servers off from the network. [1]

4. 2024-09-02

   It sent a preliminary report to the Personal Information Protection Commission and a final report on October 25. [1]

5. 2025-07-17

   It published the findings after finishing its discussions with the commission. [1] [2]

The encrypted data held about 4,000 records: names, addresses, phone and fax numbers of customers who asked for product exchange or repair, names, phone numbers and emails of partner contacts, and names, birth dates, genders, addresses, phone numbers and emails of current and former staff. The data was stored under layered encryption, and experts judged it hard for a third party to decrypt or view. No outside leak, publication by the attacker or demand for money has been found. [1] [3]