Information-Security Risks from Cyberattacks and Unauthorized Access
First written in FY2021. 1 of 4 entries say "Mitigated", first in FY2022. Latest entry: FY2026.
The whole theme swung hardest in 2024: 12 of 87 companies on the "Worse" side.
14 other companies' latest entry also says "Advanced".
- FY2026AdvancedAnnual report
「To maintain and improve information security, the group implements appropriate information-system security measures, including external cyber-risk assessments, regular employee training and awareness programs in accordance with its Basic Information Management Rules, and a system for monitoring information devices, detecting suspicious behavior and responding to it.」
In addition to existing external assessments, employee training and generative AI guidelines, the company introduced a system for monitoring information devices and detecting and responding to suspicious behavior. Generative AI is to be used safely in a closed internal environment. - FY2025ReframedAnnual report
「In recent years, the use of generative AI services has expanded. While these services help improve operational efficiency and generate ideas, they also present risks such as information leaks and copyright infringement. To address these risks, the group established guidelines for generative AI services setting out rules and precautions, and is taking measures to enable their safe use.」
The company added the risks of information leaks and copyright infringement associated with generative AI use to its existing information-security risks, including cyberattacks and unauthorized access, and disclosed measures based on dedicated guidelines. - FY2022MitigatedAnnual report
「To maintain and improve information security, the group implements appropriate information-system security measures, including external cyber-risk assessments and regular employee training and awareness programs in accordance with its Basic Information Management Rules.」
For risks such as cyberattacks and unauthorized access, the company specified external assessments and employee training and awareness programs based on its rules as countermeasures. - FY2021First statedAnnual report
「If, due to an unforeseen event such as a cyberattack or unauthorized access, the group's systems cannot be used normally or personal information is leaked outside the company, the group's operating performance could be adversely affected by delays in sales activities and business processing, damage to its reputation, and the resulting decline in sales and costs related to damages compensation.」
The company disclosed cyberattacks, unauthorized access, system outages and personal information leaks separately for the first time as risks affecting sales and business processing, its reputation, sales and damages compensation. Measures include cyber-risk assessments by external organizations and employee training.