Business Impact from Information-System Failures and Cyberattacks

「The Group has established various regulations and guidelines based on its information security policy, obtained ISMS (ISO/IEC 27001), an internationally recognized external information security certification, and set up an internal security incident reporting hotline available by telephone 24 hours a day. It also conducts vulnerability testing by third-party organizations and vulnerability assessments of server operating systems and middleware once a year, while continuously implementing technical security measures, including multilayered defense systems to detect and block external attacks and strict access-rights management.」

「Although the Group will continue explaining to the authorities the validity of its eligibility to receive the funds, the matter may affect the Group’s results depending on future developments. At present, however, it is difficult to estimate the impact on the Group’s results.」

「The Group conducts security risk assessments by third-party organizations and, based on the results, works to reduce risks by introducing the latest security software, establishing information-management regulations, strengthening security training for employees, conducting security checks on all of its e-commerce sites, including overseas sites, blocking suspicious communications, recruiting security specialists, and establishing a specialized organization operating under the Security Committee.」

「If a major disruption caused by an information-system failure, cyberattack, or other event prevents the Group's systems from being used normally, or if personal information is leaked externally through unauthorized access or other means, the Group's financial results may be affected by lost sales resulting from system shutdowns, loss of customer trust, and other factors.」