Operational Risks Including System Outages, Information Leaks and Cyberattacks
First written in FY2016. 3 of 8 entries say "Worsened", first in FY2020. Latest entry: FY2024.
Orix moved to the "Worse" side of this theme in 2020, 6 years before the typical company in this theme (2026).
The whole theme swung hardest in 2026: 4 of 11 companies on the "Worse" side.
3 other companies' latest entry also says "Mitigated".
- FY2024MitigatedAnnual report
「No information security incident that could have a material impact on management occurred during the consolidated fiscal year.」
While continuing to recognize the increasing frequency and sophistication of cyberattacks and risks originating through third parties, the company disclosed its response framework, including training at least once a year, phishing exercises, incident response exercises and the Group CSIRT, and stated that no serious information security incident occurred during the fiscal year. - FY2023WorsenedAnnual report
「Cybersecurity risks have increased significantly in recent years, and cyberattacks have become more frequent and sophisticated. In particular, heightened geopolitical tensions, including those related to Russia and Ukraine, may increase the possibility of cyberattacks in retaliation for sanctions imposed by the international community, as well as the risk of cyberattacks by other parties exploiting the situation involving Russia and Ukraine.」
The disclosure explicitly addresses the increasing frequency and sophistication of cyberattacks, retaliatory attacks arising from geopolitical tensions and risks originating through third parties, expanding on the previously disclosed risks of system failures and information leaks. - FY2022MitigatedAnnual report
「The company is working to mitigate the risk of security breaches, including system failures and information leaks involving cyberattacks and information security breaches, by establishing response structures for information security incidents and taking other measures.」
The company established an information security management function, vulnerability management, network defenses, incident response and reporting systems for the Representative Executive Officers and Audit Committee. - FY2021WorsenedAnnual report
「If these systems experience unforeseen events such as outages or malfunctions, operational errors or misconduct by officers and employees, external contractors or third parties, hacking through cyberattacks, ransomware attacks, unauthorized access, business disruption or major natural disasters, business activities may be adversely affected, including through disruptions to deposits and withdrawals, and confidential or personal information may be lost, damaged or leaked.」
The disclosure has been expanded from the previously stated risks of system outages and cyberattacks to include ransomware, business disruption, errors in information used for decision-making and service interruptions. - FY2020WorsenedAnnual report
「To address the risk of cyberattacks, which is becoming a serious management risk, the company established the Information Security Management Division in June 2018 and upgraded its security measures.」
Cyberattacks were described as "becoming a serious management risk," and the previously disclosed risks of system outages and information leaks were presented as more significant risks. - FY2019RestatedAnnual report
「If these systems experience unforeseen events such as outages or malfunctions, operational errors or misconduct by officers and employees, external contractors or third parties, computer virus attacks, hacking, unauthorized access, other cyberterrorism, or major natural disasters, business activities may be adversely affected, including through disruptions to deposits and withdrawals, and confidential or personal information may be leaked, lost or damaged.」
The company continues to disclose risks of system outages, information leaks, misconduct by external contractors, cyberattacks and business interruption. - FY2017RestatedAnnual report
「If these systems experience unforeseen events such as outages or malfunctions, operational errors or misconduct by officers and employees, external contractors or third parties, or computer virus infections, business activities may be adversely affected, including through disruptions to deposits and withdrawals, and confidential or personal information may be leaked, lost or damaged.」
The company continues to disclose operational risks associated with system failures, information leaks, external contractors and cyberattacks. - FY2016First statedAnnual report
「If these systems experience unforeseen events such as outages or malfunctions, operational errors or misconduct by officers and employees, external contractors or third parties, or computer virus infections, business activities may be adversely affected, including through disruptions to deposits and withdrawals, and confidential or personal information may be leaked or lost.」
Operational risks including information systems, outsourcing, personal information, cyberattacks and business continuity.