Fujitsu Limited, the largest Japanese IT services provider, has announced that several of the company’s computers have been compromised with malware, leading to a possible data breach.
Known details about the Fujitsu data breach
The company published the security notice late last Friday, and said that after an internal investigation, they found that files containing personal information and customer information might have been compromised/exfiltrated.
The affected computers have been disconnected and the company has strengthened the monitoring of other business computers, Fujitsu said. An investigating into the circumstances surrounding the malware’s intrusion and whether any information has been leaked is ongoing.
They also stated that there have been no reports of personal information being misused – though that doesn’t mean much if the breach happened recently.
Fujitsu didn’t say when they noticed the compromise, didn’t share a (tentative) timeline of the attack, and didn’t identify the specific malware used by the attackers.
The company has notified potentially affected “individuals and customers” and has reported the incident to the Japanese Personal Information Protection Commission.
Previous cyber attacks against Fujitsu
In June 2023, the Japanese Ministry of Internal Affairs and Communications issued a public reprimand to Fujitsu Cloud Technologies, a subsidiary of Fujitsu Limited that will soon merge with its parent company.
The Ministry demanded from Fujitsu Cloud Technologies and Fujitsu Limited an immediate implementation of security measures to protect the confidentiality of communications and to raise their cybersecurity posture.
The demand was a consequence of several breaches suffered by the two companies:
- The 2022 compromise of FENICS, Fujitsu Limited’s cloud-based internet service used by governments and large corporations, which was accessed and exploited by unauthorized parties lo leak sensitive info
- A May 2020 incident involving a compromised device used in its cloud service and subsequent lead of leak confidential communications.
Fujitsu was also involved in a supply-chain attack in May 2021. Its project management suite, Fujitsu ProjectWEB, was accessed by an unauthorized third party and the incident resulted in a data breach affecting several Japanese government agencies.
The data was allegedly sold on the dark web. The company later discontinued the ProjectWEB portal/tool.