Nishiyama Seisakusho: ransomware attack on its network

On the morning of 22 January, several PCs at Nishiyama Seisakusho could not reach server data, and an English text saying the network had been encrypted was found on a server, revealing a ransomware infection. The internal network was cut off and an outside firm began a forensic investigation. The April 3 third report traced entry to a VPN-device vulnerability and compromised account credentials. All business systems had recovered by that report, except some encrypted data, after servers, devices and networks were reinitialized. The company continued monitoring attacker-published information and contacted potentially affected partners.