NEC announced that a service provider engaged for system development and maintenance had been hit by a cyberattack, confirming outages at multiple customer systems and the leakage of files containing personal information. The attack occurred in late September, and credentials for legitimate accounts were misused, the company said.
On 20 October, NEC disclosed that a service provider had been hit by a cyberattack, causing multiple customer systems to go down and files in cloud storage shared with stakeholders to be leaked. The attack occurred in late September, and credentials for legitimate accounts were misused by a third party, the company said.
The customers’ systems were subjected to unauthorized access from the service provider’s devices using legitimate accounts. Files on the servers were encrypted, making the services unavailable. The attackers also misused legitimate access methods used for maintenance, the company said.
The leaked files included personal information held by customers and system-related information. NEC said it would report the details of the personal information to customers once they were determined. The names of the service provider and customers, the number of leaked records and the recovery status have not been disclosed.
NEC has published a related release, and further announcements are expected on the status of the investigation and details of the recovery efforts.