Risks of IT system failures and information leakage due to cyberattacks and other causes
First written in FY2021. 1 of 3 entries say "Materialised", first in FY2025-H1. Latest entry: FY2026.
The whole theme swung hardest in 2025: 11 of 52 companies on the "Worse" side.
18 other companies' latest entry also says "Mitigated".
- FY2026MitigatedAnnual report
「In the ransomware incident caused by unauthorized external access in September 2024, which encrypted some servers, no leakage of personal information held by the Group was confirmed. The Group is taking the matter seriously, further strengthening its security and monitoring systems, working to prevent recurrence, and conducting a rigorous review and renewed operation of its rules for managing personal information.」
The Company explained that although a ransomware incident occurred, no leakage of personal information was confirmed, and that it is strengthening its security and monitoring systems, personal information management rules, and measures to prevent recurrence. - FY2025-H1MaterialisedAnnual report
「Regarding the ransomware incident suffered in September, the Company disclosed in its timely disclosure dated 1 November 2024, titled “(Update on Disclosed Matter) Notice Regarding the Company's Response to the Ransomware Incident,” that an investigation by external experts had found no evidence of data leakage or other issues.」
A ransomware incident actually occurred in connection with the risk of IT system failures and information leaks caused by cyberattacks and other incidents. The Company explained that the investigation by external experts found no evidence of data leakage or other issues. - FY2021First statedAnnual report
「However, intentional acts, including cyberattacks, could result in information leaks, loss of information and various system failures, potentially damaging the Group's financial position and operating results through reputational damage and temporary interruption of business activities.」
Cyberattacks, information leaks or loss, system failures, reputational damage and business interruption associated with efficient use of IT systems are described for the first time as a standalone risk. The Company states that it will respond by clarifying authority and responsibility, implementing intrusion countermeasures, and providing employee training.