Seed Planning: ransomware attack
Early on March 2, ransomware encrypted files on some servers and computers at the market research firm Seed Planning, which cut off its network. As a subcontractor of Cross Marketing on a Tokyo Waterworks Bureau study of household water use, it held names, addresses, customer numbers and water usage for up to about 130,000 households. For five other Tokyo bureaus it held data including the names, addresses, ages and genders of 18,000 residents drawn from the resident register, and for Kawasaki City about 2,000 business contact records. After an investigation with outside experts, the company said on June 24 that it had concluded no personal data entrusted by clients had leaked.
Disclosed
2026-03-06
Organizations involved
4
Leaked or at risk
130K
130,000
Downtime
Unknown
Timeline
- Started, Detected 2026-03-02
- Disclosed 2026-03-06
- Resolved 2026-06-24
- 114 days
Attack or cause
- Method
- [Ransomware]
- Impact
- [Service outage]
- Entry point
- Unknown
Data exposed or at risk
Supply chain
Organizations involved
[Through a supplier][Moderate]Tokyo, ShinjukuElectricity, gas, heat and water130,000 leaked
Bureau of Waterworks Tokyo Metropolitan GovernmentHouseholds in the water use study, subcontracted through Cross Marketing
[Through a supplier][Moderate]TokyoPrefecture18,000 leaked
Tokyo Metropolitan GovernmentResidents in the Bureau of Public Health cancer screening study and data from four other bureaus
[Through a supplier][Moderate]Kanagawa, KawasakiMunicipality2,000 leaked
Kawasaki CityBusiness contacts from a welfare industry program; the city reported no leak on April 30
[Breached][Moderate]Tokyo, BunkyoScientific research, professional and technical services
Seed Planning, Inc.
Sources
- [1][Official]委託事業における不正アクセス被害についてBureau of Waterworks Tokyo Metropolitan Government · 2026-03-06
- [2][Official]委託業務受託者へのサイバー攻撃についてTokyo Metropolitan Government · 2026-03-09
- [3][Official]【報道発表資料】 委託事業者サーバーへの不正アクセス被害についてKawasaki City · 2026-03-26
- [4][Official]【報道発表資料】 委託事業者サーバーへの不正アクセス被害について(最終報)Kawasaki City · 2026-04-30
- [5][News]東京都の再委託事業者がサイバー攻撃被害、最大13万世帯の情報漏えい恐れ…水道使用者名や使用水量The Yomiuri Shimbun · 2026-03-07
- [6][News]シード・プランニングにランサムウェア攻撃、顧客から預かった個人情報は流出していないと判断ScanNetSecurity · 2026-07-10