ENKR

Iseto ransomware breach of outsourced print data

Add to my breach check

Made public · 3,076,477 people in client data

What leaked4

Hard to replace

  • Income, balances, loans, credit or other financial details
  • Home or delivery address

Permanent

  • Health information
  • Full name
  • Health informationhealth-insurance generic-drug notices; 13,150 people with sensitive data · PPC
  • Income, balances, loans, credit or other financial detailsdepends on the mailing: e.g. defined-contribution pension amounts, loan balances, tax amounts

To-dos

None of the harms this check covers.

What happened next14 events

  1. Undetected 1 eventNone on record · show events
  2. Response 11 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 1 eventOngoing · show events
  5. Disputes 1 eventOngoing · show events
  1. Japan's PPC: Iseto asked its clients about secondary harm from misuse of the data and had received no such report so far
  2. PPC guidance · Art. 147: 3,076,477 people in client data · 13,150 with sensitive data, 41 direct clients and about 100 organisations affected; unpatched VPN since April 2021, an 11-letter admin password unchanged since 2017, no MFA
  3. Four suspected core members of the 8Base ransomware group, which press reports name as Iseto's attacker, were arrested in an international operation
  4. Iseto announced that personal data of part-time staff at an Osaka site had also leaked
  5. VPN to be retired, authentication strengthened, client data confined to controlled areas with deletion rules and audits
9 more
  1. Forensic investigation complete: attackers entered through the VPN; client data had been kept on servers where it was not allowed and not deleted after the work
  2. Toyota City (Aichi) estimated that data of about 420,000 people may have leaked
  3. Tokushima Prefecture said about 200,000 records from its tax-notice printing may have leaked, data Iseto had reported as deleted
  4. Iseto confirmed the published data came from its servers and included personal data of clients' customers
  5. Stolen data was available for download on the attackers' dark-web leak site for a day
  6. Possible leak of personal data held for some client organisations; those clients informed
  7. First notice of the ransomware attack; no leak confirmed at that point
  8. Servers and PCs found encrypted by ransomware; company-wide response headquarters set up
  9. Police informed of the attack
Company
Iseto
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
3,076,477 people in client data · PPC: 2,509,886 private-sector, 566,561 public-sector; plus 441 Iseto staff

How the facts developed

  1. PPC guidance: 3,076,477 people, 41 direct clients, about 100 organisations including sub-contracting chains
  2. Iseto confirmed that data posted on the attackers' leak site on June 18, 2024 came from its servers and included clients' customer data

Sources