System Outages, Cyberattacks, and Personal Information Leaks
First written in FY2016. 2 of 6 entries say "Mitigated", first in FY2017. Latest entry: FY2026.
Startia Holdings moved to the "Worse" side of this theme in 2026, 1 year after the typical company in this theme (2025).
The whole theme swung hardest in 2026: 31 of 105 companies on the "Worse" side.
22 other companies' latest entry also says "Worsened".
- FY2026WorsenedAnnual report
「In recent years, cyberattacks have become more sophisticated and increasingly commercialized, as represented by the spread of RaaS (Ransomware as a Service) and advances in AI, and the threat is growing.」
Regarding information security risks, the company added the leakage of input and training data provided to AI, zero-day attacks and intentional removal of data by administrators as residual risks, in addition to the increasing sophistication of attacks through RaaS and AI. It also describes consideration of introducing EDR, ZTNA and, in the future, MDR. - FY2023RestatedAnnual report
「To strengthen the security of employees who handle such information, we are working to minimize risks and thoroughly implement information security management, including establishing relevant policies and rules, conducting regular training and audits, responding to amendments to the Act on the Protection of Personal Information, responding to external cyberattacks, and conducting drills based on assumed emergencies.」
The company reconfirms the risks of information system failures, information leaks and cyberattacks, and continues to address them through policies, training, audits, drills and third-party certification. - FY2020MitigatedAnnual report
「To strengthen the security of employees who handle such information, we are working to minimize risks and thoroughly implement information security management, including establishing relevant policies and rules, conducting regular training and audits, responding to external cyberattacks, and conducting drills based on assumed emergencies.」
As measures against information security and personal data breach risks, the company conducts third-party certification, establishes policies and rules, provides training, performs audits, responds to cyberattacks and conducts drills. - FY2018RestatedAnnual report
「However, if an incident occurs, such as hacking resembling a targeted attack beyond the level our group's crisis management system can handle, unauthorized intrusion using sophisticated social engineering, a disaster of an unforeseen scale, or a system outage caused by a bug whose discovery was delayed by a manufacturer or service provider, users of our group's services may suffer a certain amount of damage.」
The company reiterates the risks of cyberattacks, unauthorized intrusion, disasters and system failures caused by bugs, together with measures including security, resilience and support systems. - FY2017MitigatedAnnual report
「Our group works to provide stable services and operate its systems. We pay close attention to selecting data centers (IDCs) and to security and resilience in cloud environments, and have established technical response and customer support systems to prepare for service disruptions.」
The company discloses measures to address service disruptions through data center selection, cloud security and resilience, and technical and support systems. - FY2016First statedAnnual report
「If an incident occurs, such as hacking resembling a targeted attack beyond the level our group's crisis management system can handle, unauthorized intrusion using sophisticated social engineering, a disaster of an unforeseen scale, or a system outage caused by a bug whose discovery was delayed by a manufacturer or service provider, users of our group's services may suffer a certain amount of damage.」
The company identifies hacking, unauthorized intrusion, disasters and system failures caused by bugs as risks in providing services.