An analysis article organizing 11 domestic cyber incidents by entry point. The incidents, including the breach of 7.71 million records at Mura Uchi Dot Com and incidents involving TOYOBO and Yamato Transport, were disclosed from June through October. The measures required for protection are presented for each entry point.
Domestic cyber incidents that have been disclosed were organized chronologically into five entry-point categories: the company's own web systems and websites, external tools and SaaS, account takeovers and impersonation, internal data removal, and Yamato Transport, whose entry point remains undisclosed. The companies and incidents included in each category are listed, with the structure showing where protection is needed once the entry point has been identified.
For the company's own web systems and websites, the 7.71 million-record breach at Mura Uchi Dot Com was highlighted. It was disclosed that traces of unauthorized access were discovered in July and that the entry point was identified in a second report in September. Unauthorized access from overseas was detected at Ozmall, and the number of affected individuals was revised after its disclosure. The possibility of unauthorized access to Chibagin Shoten's corporate website was also indicated.
For external tools and SaaS, two Movable Type vulnerabilities were disclosed and fixed around the same time as the Mura Uchi incident. At TEMAIRAZU, a reservation management system, the possibility that guest data had been acquired unlawfully was identified. Movable Type released patched versions and provided mitigation measures.
Examples of account takeover and impersonation include the sending of approximately 1,500 suspicious emails from the TOYOBO Group, unauthorized access to the Malaysian office account of Taikisha, unauthorized use through another company's property-viewing reservation system at Land Housing, and business email compromise at the Jelly Beans Group. In each case, the damage expanded through the misuse of legitimate authentication or communication channels.
Incidents caused by internal data removal and the transfer of access rights after employees' departure include the leakage of latent curing-agent information by a former Asahi Kasei employee and the leakage of data on automated guided vehicle charging equipment from Sintech Hozumi. Strengthening information management after employees' departure was identified as a measure to prevent recurrence in both cases.