ransomware
14 articles with this tag
FortiBleed (FortiGate credential leak, about 74,000 devices): not a new vulnerability, so admin and VPN passwords must be changed
FortiBleed is the large-scale leak and misuse of administrator and SSL VPN credentials for FortiGate, Fortinet's firewall and VPN appliance. On June 18, 2026, CISA warned that credentials associated with about 74,000 devices had leaked. On June 19, Fortinet said it is not a new vulnerability and that the activity likely involves reuse of credentials from previous incidents plus brute-forcing of devices with weak passwords and no multi-factor authentication. On June 23, JPCERT/CC issued an alert saying it had confirmed that the data includes information related to Japanese companies. On October 6, the FBI and the U.S. Secret Service warned that the activity continues, that some administrators have been locked out of their devices, and that the access has been used as an entry point for ransomware. Upgrading to fixed firmware does not invalidate leaked passwords. This site's conclusion: if you run FortiGate, change admin and VPN passwords, enforce multi-factor authentication, take the management interface off the internet, and remove the legacy SHA-256 copies of admin passwords.
JR East, VIEW Card and JR Kyushu Possible Email Leak (2026): What to Do
On October 9, 2026, East Japan Railway Company (JR East), VIEW Card Co., Ltd. and Kyushu Railway Company (JR Kyushu) each announced that the external service they use to send email to members had been affected by unauthorized access at a cloud service provider, and that they could not rule out that members' email addresses and other data had been viewed or obtained. The numbers are, at most, about 1.67 million eki-net members and about 390,000 Otona no Kyujitsu Club members (JR East); about 4.03 million email addresses of VIEW's NET users (VIEW Card); and, at most, about 1.3 million JR Kyushu Web members (JR Kyushu). For eki-net, VIEW's NET and JR Kyushu Web members only email addresses are involved; for Otona no Kyujitsu Club members, the member number, credit card expiry date and date of birth are involved as well. Names, addresses, phone numbers and card numbers are excluded. The cloud service provider has said that the outage which began early on October 7 was caused by a ransomware attack by a third party. In its fifth report on October 14, the provider said it had found no trace of data in virtual servers in the affected area being viewed or taken out, and concluded that no data leaked externally. On October 15, after receiving those findings, JR Kyushu announced that no leak of JR Kyushu Web members' email addresses had been confirmed. JR East's eki-net site also says that on October 15 the email delivery service company reported that it had concluded no personal data of eki-net members leaked (checked October 19). For Otona no Kyujitsu Club members and VIEW Card, this site could find no follow-up as of October 19 (checked on each company's site). This site's take: JR Kyushu said no leak was confirmed, and eki-net says it was told no personal data of eki-net members leaked. Even so, fake emails using this incident as a pretext may still arrive. Do not log in from links in emails; check through the official app or a bookmark you saved yourself.
Osaka Metropolitan University ransomware attack (personal data leak confirmed from a contractor's cloud storage): what students, alumni, parents and staff should do
Osaka Metropolitan University in Japan says a large-scale failure hit its virtualization platform in the early hours of October 2, 2026, taking down the campus network, OMU Mail, its websites, and its academic, finance, payroll and library systems. At a press conference on October 5 it said it had concluded the cause was a ransomware attack. Classes were cancelled from October 2 to 8, and in its fourth notice on October 8 the university announced that in-person classes would resume at all campuses on October 9. In its fifth notice on October 21, the university said the contractor that maintains and operates its core systems had reported that a company it subcontracts to was hit by a cyberattack in late September 2026, and that the university's systems were accessed without authorization using the subcontractor's legitimate account. The contractor also reported that university-related personal data and system information stored in cloud storage the contractor used had been confirmed as leaked; the contents and numbers are still being checked with the contractor. The data the university flagged at its press conference as possibly leaked (about 130,000 records related to the academic affairs system, among others) sits in the university's own virtualization platform and is separate; whether it leaked is still under investigation. On October 23 the university opened a help desk for alumni and parents. News reports say about 500 servers stopped and much of the backup data was also encrypted. This site's take: check any message claiming to be from the university on the OMU Entrance page, not through links in emails or texts, and report suspicious contact to the university's help desk. Organizations should list the accounts their contractors and subcontractors use, and keep at least one backup that the production admin accounts cannot delete.
Hospital Cyberattacks in 2026: Care Disruptions and Patient Guidance
In 2026, cyberattacks disrupted care at hospitals in the US, Belgium and Japan. Laid side by side, the hospitals' own statements show one pattern: inpatient and emergency care continued on paper under downtime procedures, while outpatient clinics, chemotherapy, the hospital pharmacy, appointment phones, the patient portal, ambulance intake and imaging stopped — the functions that connect a hospital to the outside. Downtime procedures should be written for those outward-facing functions, not only for the wards. The way in can be equipment nobody counts as a clinical system, such as a VPN appliance used to maintain medical devices. Patients should check official channels, take urgent medication needs to the hospital's designated line, and not answer suspicious calls claiming to be the hospital.
Medica Shuppan Ransomware Attack (About 641,000 People): What Medical Readers, Authors and Publishers Should Do
According to Medica Shuppan Co., Ltd., it detected a system failure on March 13, 2026 that turned out to be unauthorized access involving ransomware. Its May 13 investigation report says the starting point was a third party entering the internal network with legitimate account credentials. No definitive evidence was found that personal data was taken out, but the possibility cannot be fully ruled out, so data of about 641,000 people (may include duplicates) is treated as 'at risk of leakage'. The data includes readers' names, contact details and email addresses, authors' bank account numbers and employees' HR records. The company does not hold credit card data. Emails impersonating the company have also been seen. This site's take: a specialist publisher's customer list is a list of medical professionals with their workplaces, so check any message about study materials, seminars, academic societies or manuscript fees on the official site you open yourself, not via a link. Authors should watch for messages that mention their account number to seem genuine and then ask for a PIN or online banking details.
Cariteco (Meitetsu Kyosho) Ransomware Attack: Possible Driver's Licence Data Leak and What Members Should Do
On July 2, 2026, Meitetsu Kyosho Co., Ltd. disclosed unauthorized access to its servers and a system outage detected on June 23, saying an investigation found traces of unauthorized access by ransomware. On August 4 it said it could not rule out a leak of the information members wrote on their application forms for its car-sharing service Cariteco — name, address, date of birth, phone number, email address, driver's license information and, for some members, credit card data — covering both current and former members. No count has been disclosed, and the company says no leak or misuse has been confirmed. This site's take: license data cannot be changed, so, as in the Times Car case, register a fraud alert with Japan's three credit bureaus and check your credit file. Two points are specific to this case: with ransomware, a possible leak can come to light only after the service has been restored; and some of the company's individual notices were undeliverable. Former members who have moved should contact the company rather than wait for a letter.
Data breaches and cyberattacks of 2026: a timeline (Japan and worldwide) — 203 incidents rated by impact, and what they show
This site built a timeline of 203 major data breaches and cyberattacks disclosed from January to October 2026 (99 in Japan, 103 elsewhere, 1 without a country classification), sourced to victim organizations' notices, regulator filings and attributed reporting. Impact is rated in three levels by scale and data type, with the criteria printed on the page. Our take: outside Japan, leaks of identity data — driver's licences, passports, Social Security and other government ID numbers — stand out in 29 of 103 incidents; in Japan, ransomware and vulnerabilities in internet-facing devices and systems (VPN appliances, websites, analytics tools and the like) stand out. Identity data is not as easy to replace as a password, so users should hand it to fewer services and file credit-bureau alerts when it leaks; operators should start with patching internet-facing devices and deciding how long to keep the ID documents they collect.
Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and backups encrypted along with production
The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin rights made it easy to spread to other machines in the hospital (lateral movement). Decisively, the primary system and its backup were on the same network and both were encrypted. A backup that isn't isolated and offline can't be relied on for recovery. EMR recovery took about two months. Defend by patching internet-facing VPNs fast, revoking leaked/reused credentials, and keeping isolated, offline, 3-2-1 backups.
Osaka General Medical Center ransomware (2022) — a contractor's VPN as the way in, and hospital BCP
The way in was not the hospital itself but a meal-service contractor's remote-maintenance VPN device, which was unpatched and reachable using leaked credentials, the investigation committee found. Because the hospital and contractor were constantly connected, and because servers/PCs shared passwords, users held broad admin rights, EMR servers lacked antivirus, and the network wasn't segmented, the encryption spread across the EMR system. Outpatient care, surgery, and emergency intake were restricted; full recovery took over two months. Defend by treating contractor links as your own attack surface: patch internet-facing VPNs, end credential reuse, least privilege, segment, and build a medical BCP (paper fallback, tested restore).
Capcom Ransomware (2020) — Why an Old VPN Device Was the Way In, and the Double-Extortion Defense
The way in was an old backup VPN device that had been left running at a North American subsidiary after newer units replaced it. From there the network was breached, data was stolen, and then ransomware encrypted systems (double extortion). Up to ~390,000 people's personal data was potentially exposed (no payment-card data). Capcom refused to pay, restored from backup, and disclosed transparently. Defend by decommissioning unused gear, patching edge devices, and covering both theft and encryption (segmentation, detection, backups).
KADOKAWA / Niconico Ransomware (2024) — Why It Spread Company-Wide, and Network Segmentation & BCP
The way in was described as phishing that stole an employee's credentials; from there the internal network was breached and ransomware ran, taking down many of the group's services (including Niconico) for months and leaking ~250,000 people's data. Reporting and analysis attribute the company-wide spread to systems of very different criticality sharing the same network, reportedly with too little segmentation. Defend by segmenting the network by criticality, using phishing-resistant authentication, and preparing business continuity (BCP) and recovery.
What is ransomware? How it works, how it gets in, and how to avoid paying
Ransomware is malware that encrypts your files and demands payment to get them back. Modern attacks add double extortion — they steal data first and threaten to leak it, so decryption alone doesn't stop the breach. Main entry routes: phishing, weak/no-MFA VPN/RDP, and unpatched internet-facing flaws. The single most important defense is offline/immutable backups plus restore tests — being able to recover without paying. Also prevent intrusion (MFA, patching) and limit the damage (least privilege, segmentation).
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
Backup essentials: the 3-2-1 rule and a recovery plan that survives ransomware
'I have a backup' isn't enough — only a backup you've verified you can restore is useful. The basics: the 3-2-1 rule (three copies, two media types, one offsite). For ransomware you also need at least one 'offline or immutable' copy — an always-connected backup gets encrypted along with the original. Cloud sync is not a backup (it replicates deletions and encryption too). Versioning and a periodic restore test complete the practice.