NEC contractor hit by cyberattack; customer systems down, personal data leaked
In short
NEC said on 20 October that a company it commissions for system development and maintenance was hit by a cyberattack in late September. Customers suffered unauthorised access, encrypted servers and leaks of information that included personal data. Osaka Metropolitan University and Osaka University later linked their own incidents to the same case.
Read the full story 2 min read
NEC said on 20 October that a company it commissions for system development and maintenance was hit by a cyberattack in late September, and that customers suffered unauthorised access and information leaks. Sankei and Yomiuri reported that information of three customers leaked. Yomiuri added that leaks of personal information were confirmed at two of them. [ 1 , 2 , 3 , 4 ]
ITmedia and Nikkei xTECH reported that the attacker used stolen credentials of legitimate accounts to reach customers' system environments from the contractor's terminal. Files on the customers' servers were encrypted, which made various systems unusable. TBS reported that the contractor's account was taken over. [ 2 , 5 , 6 ]
Files in cloud storage that NEC created and used to share information among customers, NEC and the contractor also leaked. According to ITmedia and Nikkei xTECH, the files contained personal information held by customers and system-related information. ITmedia said NEC had already contacted the affected customers individually and would report details of the leaked personal information as soon as they are known. [ 2 , 6 ]
NEC said it is lending the contractor terminals that it manages. It said it takes the case seriously and will strengthen and enforce contractor management and personal data management to prevent a recurrence. ITmedia said the contractor's name, the names of affected customers and the number of leaked records had not been made public as of 20 October. Yomiuri said the number and content of leaked items are under investigation. [ 2 , 3 , 4 , 6 ]
On 21 October, Asahi reported that Osaka Metropolitan University had said its system failure of 2 October was caused by a cyberattack on a business to which NEC subcontracts system development and maintenance. Asahi said files on the university's server were encrypted, leaving the system unusable. @IT described the university's damage as ransomware and said it came from the same case. [ 7 , 9 ]
Asahi also reported that Osaka University, which has also commissioned system operation to NEC, announced that personal information of graduates, current students and staff, about 78,000 people in total, had leaked. The data included email addresses, names and student numbers. The university said NEC had not reported the subcontractor involved, and described NEC's sharing and holding of files with personal information, which it said was not based on its contract with the university, as a serious problem. [ 7 ]
Why it matters
The case shows how an attack on a contractor can reach several of NEC's customers and expose personal data held by them. NEC said it would tighten contractor management and personal data management.
Key facts
- NEC announced on 20 October that a contractor for system development and maintenance was hit by a cyberattack in late September. [ 1 , 2 , 3 , 4 , 5 , 6 ]
- The attacker used stolen credentials of legitimate accounts to access customers' system environments, according to ITmedia and Nikkei xTECH. [ 2 , 6 ]
- Files on customers' servers were encrypted and systems became unusable. [ 2 , 3 , 5 , 6 , 7 ]
- Files in cloud storage that NEC used to share information with customers and the contractor also leaked, including personal and system-related information. [ 2 , 6 , 7 ]
- Sankei and Yomiuri reported that information of three customers leaked; Yomiuri said personal data leaks were confirmed at two of them. [ 3 , 4 ]
- Osaka University said on 21 October that personal information of about 78,000 people leaked, including email addresses, names and student numbers, according to Asahi. [ 7 ]
- Osaka Metropolitan University said on 21 October that its system failure of 2 October was caused by the attack on NEC's subcontractor, according to Asahi. [ 7 , 9 ]
Confirmed by several sources
- A company commissioned by NEC for system development and maintenance was hit by a cyberattack in late September, and NEC announced it on 20 October. [ 1 , 2 , 3 , 4 , 5 , 6 ]
- Stolen legitimate account credentials were abused to access customer systems. [ 2 , 3 , 5 , 6 , 7 ]
- Files on customer servers were encrypted, leaving systems unusable. [ 2 , 3 , 5 , 6 , 7 ]
- Files in cloud storage used by NEC to share information among customers, NEC and the contractor leaked, including personal information. [ 2 , 6 , 7 ]
- Information of three customers leaked. [ 3 , 4 ]
- NEC is lending the contractor terminals that NEC manages as a countermeasure. [ 2 , 3 , 6 ]
Still unclear
- Number of leaked records and details of the personal information. Yomiuri said the count and contents are under investigation; ITmedia said NEC will report details to customers once known.
- Names of the contractor and the affected customers. ITmedia said they had not been made public as of 20 October.
- Whether the two Osaka universities are among the three customers reported by Sankei and Yomiuri. The documents do not say.
- Whether the company attacked is a contractor or a subcontractor of NEC. Most outlets call it a contractor (itakusaki), while Asahi calls it a re-contractor (saiitakusaki) and describes NEC as subcontracting the work to it.
What local media are saying
Timeline, local time
- ASCII.jp reported on 20 October that NEC had announced the attack on its contractor. [ 1 ]
- Sankei reported on 20 October that information of three customers had leaked. [ 3 ]
- Yomiuri reported on 20 October that personal data leaks were confirmed at two of the three customers. [ 4 ]
- Asahi reported on 21 October that Osaka Metropolitan University attributed its 2 October system failure to the attack, and that Osaka University announced a leak of about 78,000 people's data. [ 7 ]
- @IT reported on 22 October that the Osaka Metropolitan University ransomware damage originated from the attack on NEC's contractor. [ 9 ]