Ransomware incident at an overseas consolidated subsidiary
SANKO FASTEM (VIETNAM) LTD. (the subsidiary concerned)
The subsidiary's information systems and data on its internal servers
Unauthorised access by a third party through configuration deficiencies in network equipment
Company response
An investigation to determine the cause was conducted with the assistance of external specialist organisations.
The Company corrected the network equipment configurations that caused the incident, blocked external connection routes, reviewed remote connection methods, changed administrator authentication credentials, isolated infected servers, and restored them in a secure environment. It will continue conducting inspections and reviews to prevent recurrence.
The Company has determined that the impact of this matter on the consolidated results of the Group is immaterial.
Related procedures
Relevant authorities in Vietnam
If any new matters requiring disclosure come to light regarding this matter, the Company will promptly announce them.
The Company will promptly announce any new matters requiring disclosure if they come to light.
| Item | Details |
|---|---|
| Event name | Ransomware incident at an overseas consolidated subsidiary |
| Date of occurrence | August 2026 (exact date: Not disclosed) |
| Subject Entity | SANKO FASTEM (VIETNAM) LTD. (the subsidiary concerned) |
| Target Locations / Products | The subsidiary's information systems and data on its internal servers |
| Cause | Unauthorised access by a third party through configuration deficiencies in network equipment |
| Impact on Earnings Forecast | The Company has determined that the impact of this matter on the consolidated results of the Group is immaterial. |
| Court or authority | Relevant authorities in Vietnam |
| Investigation structure | An investigation to determine the cause was conducted with the assistance of external specialist organisations. |
| Measures to prevent recurrence | The Company corrected the network equipment configurations that caused the incident, blocked external connection routes, reviewed remote connection methods, changed administrator authentication credentials, isolated infected servers, and restored them in a secure environment. It will continue conducting inspections and reviews to prevent recurrence. |
| Outlook | If any new matters requiring disclosure come to light regarding this matter, the Company will promptly announce them. |
| Planned follow-up disclosure | The Company will promptly announce any new matters requiring disclosure if they come to light. |
Items this document does not state (14)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.Unauthorised access by a third party occurred through configuration deficiencies in network equipment, resulting in data encryption and leakage. However, the Company has determined that the impact on consolidated results is immaterial.