Risk of personal-information leakage
First written in FY2016. 2 of 6 entries say "Restated". Latest entry: FY2025.
Lixil moved to the "Worse" side of this theme in 2021, 5 years before the typical company in this theme (2026).
The whole theme swung hardest in 2026: 33 of 106 companies on the "Worse" side.
11 other companies' latest entry also says "Materialised".
- FY2025MaterialisedAnnual report
「The US business pursued portfolio optimization through structural reforms, but reported lower revenue and lower profit due to continued weak demand and the impact of system outages caused by unauthorized access by a third party.」
A system outage caused by unauthorized access by a third party actually occurred and contributed to lower revenue and lower profit in the US business. In addition, the impact level of information and cybersecurity risk changed from “Medium” to “High.” - FY2022WorsenedAnnual report
「In light of the increasing exposure resulting from increasingly sophisticated and frequent cyberattacks and the promotion of digital transformation, the likelihood of occurrence has changed from “Medium” to “High.”」
Regarding information security, the likelihood assessment has changed from “Medium” to “High” due to increasingly sophisticated and frequent cyberattacks and the promotion of digital transformation. - FY2021ReframedAnnual report
「The Group has established an Information Security Committee and is implementing continuous improvements in information security management by developing internal information security policies and procedures, taking measures to prevent unauthorized access and other incidents, and providing employee training, while regularly evaluating and reviewing these initiatives.」
The scope of disclosure has been expanded from the former risk of personal information breaches to overall information security risk management, including network disruptions, core systems, cyberattacks, and information breaches while working from home. - FY2018RestatedAnnual report
「In addition, to address cyberattacks as a whole, the Group has established a CSIRT (Computer Security Incident Response Team), continuously monitors unauthorized external access, and has built a framework to ensure an appropriate response in the event of an incident.」
Continuing personal information management through the responsible body, policies and procedures, and training, as well as continuous monitoring and incident response by the CSIRT. - FY2017RestatedAnnual report
「The Group is working to strengthen its management of personal information by establishing a responsible body, developing relevant policies and procedures, and continuing to provide appropriate training.」
Continuing to strengthen personal information management through the responsible body, policies and procedures, and training. - FY2016First statedAnnual report
「The Group is working to strengthen its management of personal information by establishing a responsible department, developing relevant policies and procedures, and continuing to provide appropriate training.」
The loss of public trust and the resulting costs due to a personal information breach are assumed as risks.