Cyberattack, Information Leak and System Outage Risks
First written in FY2016. 3 of 11 entries say "Restated". Latest entry: FY2026.
Honda Motor moved to the "Worse" side of this theme in 2019, 7 years before the typical company in this theme (2026).
The whole theme swung hardest in 2026: 32 of 102 companies on the "Worse" side.
23 other companies' latest entry also says "Worsened".
- FY2026WorsenedAnnual report
「The Group is also conducting technology research using AI. While AI is expected to improve production efficiency, it may also result in unintended infringement of third-party rights, the spread of misinformation and information leaks.」
In addition to the existing cyberattack and system outage risks, the disclosure adds the risks of infringing third-party rights, spreading misinformation and leaking information through the use of AI. - FY2025AdvancedAnnual report
「When introducing third-party packaged products and cloud services, the Group assesses risks based on established security standards and makes an implementation decision followed by annual post-implementation reviews.」
In addition to the existing global response framework, exercises and personnel development, the disclosure specifies pre-implementation assessments and annual post-implementation reviews for third-party products and cloud services, as well as supplier verification. - FY2024WorsenedAnnual report
「Demand is increasing particularly in software areas represented by autonomous driving, advanced driver assistance systems, including the use of AI technology, and digital services. Cyberattacks are becoming more sophisticated and complex, and their targets span countries around the world.」
The disclosure states that, amid the expansion of autonomous driving, advanced driver assistance and digital services and the use of AI, cyberattacks have become more sophisticated and complex and the importance of protecting personal information has increased. - FY2023RestatedAnnual report
「The Group has established a Cybersecurity Committee and built a global response framework spanning business and production systems, software, quality and other areas. It is developing rules and procedures based on applicable laws and regulations, establishing response workflows, verifying and addressing areas for improvement through cybersecurity exercises, and developing personnel.」
The disclosure reconfirms measures including a global Cybersecurity Committee covering products, production equipment and information systems, exercises and personnel development. - FY2022AdvancedAnnual report
「For cyberattacks on products, the Group established a Cybersecurity Committee and built a global response framework. It is developing rules and procedures based on applicable laws and regulations, establishing response workflows, verifying and addressing areas for improvement through cybersecurity exercises, and developing personnel. … For cyberattacks on production equipment, the Group is also verifying production equipment at each site in Japan and overseas and implementing measures to strengthen security.」
In addition to restoration and recurrence-prevention measures following the 2020 cyberattack, the disclosure specifies a Cybersecurity Committee covering products and production equipment, exercises and a global response framework. - FY2021MitigatedAnnual report
「The Group restored office computers and other equipment affected by the disruption, investigated the cause and the cyberattack’s entry route, and formulated and implemented measures to prevent recurrence.」
Following the temporary interruption to operations caused by the June 2020 cyberattack, the Group carried out restoration work, investigated the cause and entry route, and formulated and implemented measures to prevent recurrence. No leakage of customer or other information has been confirmed as of the present time. - FY2020MaterialisedAnnual report
「On 8 June 2020, a cyberattack on the Group caused widespread connection failures affecting office computers and other equipment, resulting in temporary interruptions to operations at some locations, including production facilities.」
A cyberattack actually caused widespread connection failures and temporary interruptions to operations at some locations. Although no leakage of customer or other information has been confirmed as of the present time, investigations into the cause and measures against similar attacks are continuing. - FY2019WorsenedAnnual report
「As information technologies such as IoT, which have evolved rapidly in recent years, become indispensable to vehicle control, the importance of measures against cyberattacks on the Group’s business is increasing. … The resulting leakage of confidential and personal information, suspension of critical operations or services, decline in brand image and public trust, liability for damage to affected customers and other stakeholders, payment of penalties, stagnation or delays in production activities, and loss of the Group’s competitiveness may adversely affect the Group’s business and results of operations.」
Against the backdrop of IoT becoming indispensable to vehicle control, the disclosure expands the scope of potential impacts to include personal information leaks, penalties, production disruptions and loss of competitiveness. - FY2018RestatedAnnual report
「To protect confidential information and other data handled by these systems and networks, the Group has implemented management systems, information-handling procedures and employee training, including oversight of outsourced service providers, as well as hardware- and software-based security measures. However, external cyberattacks, equipment malfunctions, deficiencies in management or human error within the Group or its outsourced service providers, and unforeseen events such as natural disasters or infrastructure failures may result in the leakage of confidential information and other data, the suspension of critical operations or services, improper administrative processing, or the destruction or alteration of critical data.」
The disclosure describes oversight of outsourced service providers, procedures, employee training and hardware- and software-based measures, while continuing to identify cyberattack, information leakage and system outage risks. - FY2017RestatedAnnual report
「To protect confidential information and other data handled by these systems and networks, the Group has implemented management systems, information-handling procedures and employee training, including oversight of outsourced service providers, as well as hardware- and software-based security measures. However, external cyberattacks, equipment malfunctions, deficiencies in management or human error within the Group or its outsourced service providers, and unforeseen events such as natural disasters or infrastructure failures may result in the leakage of confidential information and other data, the suspension of critical operations or services, improper administrative processing, or the destruction or alteration of critical data.」
The disclosure describes management systems, including oversight of outsourced service providers, procedures, employee training and hardware- and software-based measures, while continuing to identify cyberattack, information leakage and system outage risks. - FY2016First statedAnnual report
「However, external cyberattacks, equipment malfunctions, deficiencies in management or human error within the Group or its outsourced service providers, and unforeseen events such as natural disasters or infrastructure failures may result in the leakage of confidential information and other data, the suspension of critical operations or services, improper administrative processing, or the destruction or alteration of critical data.」
The disclosure covers information system and network risks involving not only the Group but also its outsourced service providers.