In March 2022, Toyota suspended operations at all 14 of its domestic plants. The cause was a cyberattack on Kojima Industries Corporation, which supplied parts, and the incident is cited as an example of a supply-chain attack spreading to the company itself.
This article uses a hypothetical case modelled on the 2022 cyberattack on Kojima Industries Corporation to outline how a security incident at a business partner can affect a company’s own production. Toyota was faced with the decision of whether to maintain connections to avoid disrupting the parts supply network or sever those connections to prevent a production stoppage. In practice, how to handle connections with an attacked supplier is a key issue.
There are 3 types of supply-chain attacks. The first targets suppliers whose defences are weaker than those of the main company. The second spreads to business partners through an intrusion route. The third targets a company that supplies parts to many businesses, causing damage to a large number of companies. Manufacturing supply chains can involve more than 100,000 companies, making it difficult to monitor every company, but the number of business partners directly connected to one’s own company is comparatively limited, a point that requires attention.
Large companies sometimes entrust the provision and operation of systems for business partners to their own system subsidiaries, which changes the key points of connection management. As a case study, the article presents a question about how a company should respond when a business partner suffers a ransomware attack, and discusses the views of frontline personnel and the appropriateness of management’s decision-making.