Cyberattacks, Information Leaks, and Product and Service Shutdowns
First written in FY2016. 4 of 7 entries say "Mitigated", first in FY2023. Latest entry: FY2026.
Panasonic Holdings moved to the "Worse" side of this theme in 2021, 5 years before the typical company in this theme (2026).
The whole theme swung hardest in 2024: 12 of 87 companies on the "Worse" side.
47 other companies' latest entry also says "Mitigated".
- FY2026MitigatedAnnual report
「Expanding anomaly monitoring of infrastructure including networks, servers, and personal computers at domestic and overseas subsidiaries, and integrating it with security monitoring inside factories, to strengthen a global, centralized security monitoring framework; and promoting redundancy in critical systems and the use of cloud services alongside existing systems to prevent information systems from going offline and, if an outage occurs, to prevent it from becoming prolonged.」
Following the unauthorized access, the response expanded to global, centralized monitoring, integration with factory security, redundancy and the use of cloud services alongside existing systems, backups, and product security inspections. - FY2025MitigatedAnnual report
「Employee education and training to improve security awareness and promote behavioral change: at least 4 times a year; 5 times … Incident response training by specialist teams based on assumed cyberattacks: at least once a year; 2 times … Number of serious incidents: 0; 0」
Centered on the Cybersecurity Oversight Office, the company conducted employee training 5 times and specialist team training 2 times, and disclosed a record of 0 serious incidents. - FY2024MitigatedAnnual report
「In fiscal 2023, as part of efforts to strengthen cybersecurity, the company established the Cybersecurity Oversight Office at PHD and appointed chief cybersecurity officers at each operating company in April, integrating common functions for information, product, and factory security to promote a centralized and comprehensive response to complex cybersecurity risks and risks across the entire supply chain.」
The response following the unauthorized access expanded to an integrated monitoring and response framework covering information, products, factories, and the supply chain, as well as cross-organizational training. - FY2023MitigatedAnnual report
「In fiscal 2022, as part of efforts to strengthen the response to cyber incidents, the company conducted cross-organizational incident response training alongside a review of its response processes. … In April 2023, the company established the Cybersecurity Oversight Office as a new organization and appointed a chief cybersecurity officer at each operating company to oversee responses to complex cybersecurity risks.」
Following the unauthorized access, the company proceeded with cross-organizational training, a review of response processes, and the establishment of the Cybersecurity Oversight Office and chief cybersecurity officers at each operating company. - FY2022MaterialisedAnnual report
「On 11 November 2021, the Group confirmed unauthorized access to its network by a third party. After confirming the unauthorized access, it established an emergency response headquarters, engaged external security advisers to investigate the breach and implement emergency measures, and worked to determine the full extent of the damage and implement permanent measures.」
Cyber risk had previously been disclosed as a possibility, but the company disclosed that unauthorized access by a third party had actually occurred on 11 November 2021. - FY2021WorsenedAnnual report
「An increasing number of our products, services and production facilities use the internet. Although we are implementing security measures to protect them from external threats, unexpected intrusions into products or services through networks, unauthorized operation and other incidents could result in the leakage of personal information, disclosure of information externally, service disruptions and impacts on production processes.」
The scope of cyber risk was specified to include not only information leaks, but also intrusions into network-connected products and services and production facilities, unauthorized operation, service outages, and impacts on production processes. - FY2016First statedAnnual report
「This information could be disclosed externally through intentional acts, including unauthorized access to systems and cyberattacks, or through negligence and other causes.」
In addition to the leakage of customer information and trade secrets, the company identified intrusion into and unauthorized operation of network-connected products and production facilities as risks.