Leakage of Personal Information and Trade Secrets and Cyberattacks
First written in FY2018. 2 of 3 entries say "Mitigated", first in FY2021. Latest entry: FY2026.
The whole theme swung hardest in 2026: 14 of 76 companies on the "Worse" side.
- FY2026MitigatedAnnual report
「Through regular assessments of the Group's information security measures by third-party organizations, we confirm the suitability of our information security framework based on international guidelines and industry standards, conduct regular vulnerability assessments of systems and applications developed and operated in-house, and establish a framework for aggregating and analyzing various internal log data, thereby enabling early detection of anomalies and prompt response.」
Additional measures, including third-party assessments, vulnerability assessments, log analysis, and frameworks for early detection and response, have been established to address information leakage and cyberattacks. - FY2021MitigatedAnnual report
「In preparation for external cyberattacks, we are strengthening information security measures, including implementing measures at Internet entry and exit points. We have also established SGH-CSIRT (SG Holdings Computer Security Incident Response Team), an organization within the Group dedicated to responding to cyberattacks, joined the Council of Japan Computer Security Incident Response Teams, and are working to further enhance information security measures.」
Concrete measures against information leakage and cyberattack risks include entry and exit point controls, the establishment of SGH-CSIRT, and membership in an external council. - FY2018First statedAnnual report
「If information is leaked or lost due to system trouble, unauthorized access, the intentional or negligent actions of Group employees, computer viruses or other causes, this could reduce the Group's social credibility」
The risk of leakage or loss associated with holding customer and employee information and trade secrets is explicitly indicated.