Risk of Service Outages and Loss of Trust Caused by Cyberattacks and Information Leaks
First written in FY2017. 9 of 19 entries say "Restated". Latest entry: FY2026.
Ly moved to the "Worse" side of this theme in 2026, the same year as the typical company in this theme.
The whole theme swung hardest in 2024: 12 of 87 companies on the "Worse" side.
12 other companies' latest entry also says "Materialised".
- FY2026MaterialisedAnnual report
「In October 2025, a system failure caused by a ransomware attack occurred at ASKUL Corporation, a consolidated subsidiary of the Company, affecting some business activities. In February 2026, an unauthorized access incident also occurred at a consolidated subsidiary of BEENOS株式会社, a Group company.」
The risk of cyberattacks and system outages materialized in multiple incidents, including the ransomware attack at ASKUL and the unauthorized access incident at a BEENOS subsidiary. - FY2026-H1MaterialisedAnnual report
「On 19 October 2025, we confirmed that a system outage caused by a ransomware infection had occurred at our consolidated subsidiary ASKUL Corporation. In cooperation with outside experts and relevant organizations, we are investigating the scope of the impact, including any external leakage of personal information and customer data, and working to restore the systems.」
The risk of cyberattacks and system outages materialized at ASKUL Corporation in the form of a system failure caused by a ransomware infection. The scope of the impact, including any leakage of personal information and customer data, is reportedly still under investigation. - FY2025AdvancedAnnual report
「Specifically, the Company is taking measures including establishing a Security Governance Committee chaired by the Company's President and CEO to further advance responses related to the incident and provide a forum for discussing the Company's broader issues. It is also establishing a Group CISO Board comprising the Company's CISO, the CISOs of its principal Group companies, including those overseas, and the CISO of SoftBank Corp. as an observer, thereby creating a framework for a fundamental review and enhancement of security governance across the Group.」
In response to the unauthorized access incident, the Company established a Security Governance Committee chaired by the President and CEO and a Group CISO Board, thereby putting in place cross-group security governance. - FY2024MaterialisedAnnual report
「In connection with cybersecurity risks, following the unauthorized access incident announced on 27 November 2023, the Company has reported the matter to the Ministry of Internal Affairs and Communications and the Personal Information Protection Commission and is advancing measures based on administrative guidance and recommendations. However, if these efforts are deemed inadequate, the incident could damage the Group's credibility and affect its business performance and other matters.」
The risk of cyberattacks and information leaks materialized in the form of the unauthorized access incident in November 2023, requiring measures based on administrative guidance and recommendations. - FY2024-Q3RestatedAnnual report
「However, if these measures prove inadequate and damage such as information leaks, data destruction or alteration, or service outages occurs due to human error in operations, intentional unlawful acts, system failures caused by disasters or other events, cyberattacks such as malware infections and targeted attacks, or vulnerabilities in systems or products, this could not only affect the Group's business performance but also damage its reputation and credibility. The Company also supports the information security of Group companies.」
The Company has reconfirmed the risks that cyberattacks, information leaks, data alteration and service outages could affect business performance and credibility, as well as its information security support for Group companies. - FY2024-Q1RestatedAnnual report
「During the first quarter of the current fiscal year, there were no occurrences of the major risks that management recognizes as potentially having a material impact on the Group's financial position, operating results or cash flows, among the matters concerning the business and accounting conditions described in the annual securities report for the previous fiscal year, and no material changes to the section titled "Business and Other Risks" in that report.」
The Company states that there have been no occurrences of major risks or material changes to the risks described in the previous year's report. - FY2023RestatedAnnual report
「The Group is working to secure sufficient funding to implement necessary and proactive measures against increasingly sophisticated cyberattacks and other threats. However, if cyberattacks and other threats occur beyond expectations, additional costs may arise and affect the Group's business performance.」
The Group has reconfirmed the risks associated with assuming increasingly sophisticated cyberattacks, including the possibility of sharing and supporting the implementation of countermeasures at Group companies and incurring additional costs. - FY2020WorsenedAnnual report
「Assuming that the risk of attacks against the services provided by the Group will increase further, the Group is working to strengthen its cybersecurity posture beyond normal levels so that it can respond appropriately, based on an understanding of past incidents and assuming that cyberattacks will become more sophisticated and frequent.」
In anticipation of increasingly sophisticated and frequent cyberattacks associated with the Tokyo Olympic and Paralympic Games, the risk has been specified as requiring measures beyond those taken under normal circumstances. - FY2020-Q3RestatedAnnual report
「During the 3rd quarter of the current consolidated fiscal year, there were no material changes in financial position, operating results or cash flows, including any abnormal fluctuations, or in the “Business and Other Risks” described in the annual securities report for the previous fiscal year.」
The company states that there have been no material changes regarding the risk of service outages and reputational damage caused by cyberattacks and information leaks. - FY2020-Q1RestatedAnnual report
「During the 1st quarter of the current consolidated fiscal year, there were no material changes in financial position, operating results or cash flows, including any abnormal fluctuations, or in the “Business and Other Risks” described in the annual securities report for the previous fiscal year.」
The company states that there have been no material changes regarding the risk of service outages and reputational damage caused by cyberattacks and information leaks. - FY2019RestatedAnnual report
「However, if these measures prove inadequate and damage such as information leaks, data destruction or alteration, or service outages occurs due to human error in operations, intentional unlawful acts, system failures caused by disasters or other events, cyberattacks such as malware infections and targeted attacks, or vulnerabilities in systems or products, this could not only affect the Group's business performance but also damage its reputation and credibility.」
The Group continues to disclose the risk of information leaks and service outages caused by human error, malware, targeted attacks, vulnerabilities and other factors. - FY2019-Q3RestatedAnnual report
「During the 3rd quarter of the current consolidated fiscal year, there were no material changes in financial position, operating results or cash flows, including any abnormal fluctuations, or in the “Business and Other Risks” described in the annual securities report for the previous fiscal year.」
The company states that there have been no material changes regarding the risk of service outages and reputational damage caused by cyberattacks and information leaks. - FY2018WorsenedAnnual report
「The Group is working to secure sufficient funding to implement necessary and proactive measures against increasingly sophisticated cyberattacks and other threats. However, if cyberattacks and other threats occur more frequently or on a larger scale than anticipated, additional costs may arise and affect the Group's business performance.」
The risk disclosure has been expanded to assume that cyberattacks will become increasingly sophisticated and increase beyond expectations, and it explicitly states the possibility of additional costs. No actual damage is reported. - FY2018-Q3RestatedAnnual report
「During the 3rd quarter of the current consolidated fiscal year, there were no material changes in financial position, operating results or cash flows, including any abnormal fluctuations, or in the “Business and Other Risks” described in the annual securities report for the previous fiscal year.」
The company states that there have been no material changes regarding the risk of service outages and reputational damage caused by cyberattacks and information leaks. - FY2018-Q1RestatedAnnual report
「During the 1st quarter of the current consolidated fiscal year, there were no material changes in financial position, operating results or cash flows, including any abnormal fluctuations, or in the “Business and Other Risks” described in the annual securities report for the previous fiscal year.」
The company states that there have been no material changes regarding the risk of service outages and reputational damage caused by cyberattacks and information leaks. - FY2017First statedAnnual report
「However, if these measures prove insufficient and damage occurs, including information leaks, destruction or tampering with data, or service outages, due to system failures caused by human error or intentional misconduct in operations, disasters or other events, cyberattacks such as malware infections or targeted attacks, or vulnerabilities in systems or products, this could affect the performance of the group and potentially damage its reputation.」
The company discloses cyberattacks, malware, vulnerabilities, information leaks, data tampering and service outages as individual information security risks.