Notice and Apology Regarding the Information Leak (Notice of Ransomware Incident (Fourth Report))
ANABUKI KOSAN INC. and the Group
Our communications equipment, internal network and multiple servers. Some information on customers involved in real estate negotiations and transactions, candidates for mid-career recruitment, and current and former directors and employees
An attack exploiting a vulnerability in our communications equipment resulted in unauthorized access to the internal network. After the intrusion, login attempts were made to multiple servers using remote desktop and other means. Administrator privileges were then obtained unlawfully, the scope of the intrusion was expanded throughout the network, and ransomware was deployed on multiple servers.
Company response
The affected equipment was disconnected from the internal network and the Internet. Sales activities have continued as usual since the incident occurred, and no business suspension is disclosed.
Operations are being resumed sequentially for equipment once its safety has been confirmed. The planned date for a full resumption is Not disclosed.
Investigations by external security experts and external specialist organizations, including a forensic investigation. No third-party committee or special investigation committee is disclosed.
Isolation of systems affected by unauthorized access and disconnection from the network; forensic investigation by an external specialist organization; identification of the scope of the damage and measures to prevent its spread; reporting to relevant authorities, including the police, the Personal Information Protection Commission and the Regional Development Bureau; individual contact with affected parties and establishment of an inquiry desk; comprehensive renewal of the existing infrastructure and fundamental reconstruction of the system and network architecture through migration from an on-premises environment to a cloud-native platform; implementation of advanced security technologies, including zero-trust architecture and an identity management platform, and establishment of an advanced operational framework; continued verification by an external specialist provider of the Company's initiatives; and reconstruction of the security governance framework centered on strengthening the risk management framework and company-wide internal controls
No amount disclosed. The impact of this incident on our results is expected to be immaterial.
The impact of this incident on our results is expected to be immaterial. No revision to the earnings forecast is disclosed.
Related procedures
Relevant authorities, including the police, the Personal Information Protection Commission and the Regional Development Bureau (reporting recipients)
Investigations by external specialist organizations will continue to prevent secondary damage. If any additional leakage is confirmed or the possibility of additional leakage becomes apparent, the affected parties will be contacted promptly. The existing infrastructure will be renewed, and the system and network architecture, security technologies, operational framework, internal controls and security governance framework will be reconstructed.
If facts requiring further disclosure become apparent as the investigation progresses, they will be announced promptly.
| Item | Details |
|---|---|
| Event name | Notice and Apology Regarding the Information Leak (Notice of Ransomware Incident (Fourth Report)) |
| Date of occurrence | 3 February 2026 |
| Date recognized / date notice received | 3 February 2026 (an anomaly was detected through system monitoring, and the encryption incident was confirmed) |
| Subject Entity | ANABUKI KOSAN INC. and the Group |
| Target Locations / Products | Our communications equipment, internal network and multiple servers. Some information on customers involved in real estate negotiations and transactions, candidates for mid-career recruitment, and current and former directors and employees |
| Cause | An attack exploiting a vulnerability in our communications equipment resulted in unauthorized access to the internal network. After the intrusion, login attempts were made to multiple servers using remote desktop and other means. Administrator privileges were then obtained unlawfully, the scope of the intrusion was expanded throughout the network, and ransomware was deployed on multiple servers. |
| Amount of Impact on Business Performance | No amount disclosed. The impact of this incident on our results is expected to be immaterial. |
| Impact on Earnings Forecast | The impact of this incident on our results is expected to be immaterial. No revision to the earnings forecast is disclosed. |
| Court or authority | Relevant authorities, including the police, the Personal Information Protection Commission and the Regional Development Bureau (reporting recipients) |
| Suspended operations | The affected equipment was disconnected from the internal network and the Internet. Sales activities have continued as usual since the incident occurred, and no business suspension is disclosed. |
| Scheduled resumption date | Operations are being resumed sequentially for equipment once its safety has been confirmed. The planned date for a full resumption is Not disclosed. |
| Investigation structure | Investigations by external security experts and external specialist organizations, including a forensic investigation. No third-party committee or special investigation committee is disclosed. |
| Measures to prevent recurrence | Isolation of systems affected by unauthorized access and disconnection from the network; forensic investigation by an external specialist organization; identification of the scope of the damage and measures to prevent its spread; reporting to relevant authorities, including the police, the Personal Information Protection Commission and the Regional Development Bureau; individual contact with affected parties and establishment of an inquiry desk; comprehensive renewal of the existing infrastructure and fundamental reconstruction of the system and network architecture through migration from an on-premises environment to a cloud-native platform; implementation of advanced security technologies, including zero-trust architecture and an identity management platform, and establishment of an advanced operational framework; continued verification by an external specialist provider of the Company's initiatives; and reconstruction of the security governance framework centered on strengthening the risk management framework and company-wide internal controls |
| Outlook | Investigations by external specialist organizations will continue to prevent secondary damage. If any additional leakage is confirmed or the possibility of additional leakage becomes apparent, the affected parties will be contacted promptly. The existing infrastructure will be renewed, and the system and network architecture, security technologies, operational framework, internal controls and security governance framework will be reconstructed. |
| Planned follow-up disclosure | If facts requiring further disclosure become apparent as the investigation progresses, they will be announced promptly. |
Items this document does not state (10)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The attack exploited a vulnerability in our communications equipment to gain unauthorized access to the internal network. After obtaining administrator privileges, the attackers deployed ransomware on multiple servers.