Information System Outages and Information Security Deficiencies
First written in FY2016. 3 of 6 entries say "Mitigated", first in FY2020. Latest entry: FY2025.
The whole theme swung hardest in 2026: 33 of 106 companies on the "Worse" side.
- FY2025.Annual report
「As preventive measures, the Group has established a CSIRT (Computer Security Incident Response Team), provided personal information protection training, developed incident response procedures, conducted regular drills and raised internal awareness using the latest case studies. It has also introduced a CSPM (Cloud Security Posture Management) service to detect configuration deficiencies that could lead to unauthorized access or information leaks, and has implemented incident detection and notification measures for critical services.」
In addition to existing measures such as ISMS, GDPR compliance and a CSIRT, the Group has specified incident response procedures, regular drills, the introduction of CSPM and detection and notification measures for critical services. - FY2024.Annual report
「As measures to address this risk, the Group has implemented system controls to prevent unauthorized access, including firewalls and VPNs, established systems based on ISMS (Information Security Management System) standards and a CSIRT (Computer Security Incident Response Team), and provided personal information protection training. To support its global business, the Group is strengthening its response by establishing internal rules and other measures that take into account the GDPR (EU General Data Protection Regulation) and other laws and regulations in each country and region.」
The Group continues to describe information systems failures and information security risks, together with measures including firewalls, VPNs, ISMS, a CSIRT and compliance with regional regulations. - FY2022.Annual report
「As measures to address this risk, the Group has implemented system controls to prevent unauthorized access, including firewalls and VPNs, established systems based on ISMS (Information Security Management System) standards and a CSIRT (Computer Security Incident Response Team), and provided personal information protection training. In addition, because its management strategy calls for continued investment globally, the Group has established an information management system compliant with the GDPR (EU General Data Protection Regulation) and other laws and regulations in each country and region.」
In addition to its existing firewall, VPN, ISMS and GDPR measures, the Group explicitly identifies the establishment of a CSIRT and compliance with the laws and regulations of each country and region. - FY2020.Annual report
「As measures to address this risk, the Group has implemented system controls to prevent unauthorized access, including firewalls and VPNs, established systems based on ISMS (Information Security Management System) standards, and provided personal information protection training. In addition, because its management strategy calls for continued investment globally, the Group has established an information management system compliant with the GDPR (EU General Data Protection Regulation).」
In addition to firewalls, VPNs, an ISMS-compliant framework and personal information protection training, the Group has established an information management system compliant with the GDPR. - FY2018.Annual report
「If disruptions occur in information systems, including communication networks and power systems, or information security deficiencies arise, including leaks of personal information caused by computer viruses, cyberattacks or similar incidents, the Group may suffer reputational damage, loss of customers and liability for damages, among other impacts.」
The Company explicitly includes computer viruses and cyberattacks among the previously identified risks of systems failures and personal information leaks. - FY2016.Annual report
「If disruptions occur in information systems, including communication networks and power systems, or information security deficiencies arise, including leaks of personal information, the Group may suffer reputational damage, loss of customers and liability for damages, among other impacts.」
The Company states that information systems failures and leaks of personal information, among other incidents, could affect its reputation, customers and liability for damages.