9 results for “japancyberwatch”
Asahi Kasei Therapeutics (formerly Asahi Kasei Pharma): attackers broke into the member database of Pharma DIGITAL, its site for healthcare professionals in Japan, run by vendor Pharma Information Network.
- Up to 514,000 HCPs: names, workplaces, job types, specialties
- ~44,000 with email addresses
- Detected Oct 2; site offline
- Follows Sanofi Japan's 2024 leak of ~730K records via a contractor
https://japancyberwatch.com/articles/asahi-kasei-therapeutics-pharma-digital-breach-2026
Update on the Nikkei breach: the phishing sent from a hijacked Nikkei Microsoft 365 account on Sep 30 worked on at least one recipient.
Nikkei BP, a Nikkei group publisher, says an employee entered their login after a phishing email from a Nikkei employee's address, and their own mailbox was then accessed (26 contacts' names and emails exposed).
Each mailbox taken over gives attackers a new list of contacts who trust the sender.
Supply chain breach in Japan: attackers logged in to the admin site of Scala Communications' FAQ system i-ask and planted a program on a shared server.
- Up to 713,126 inquiries from up to 5 clients
- Daiwa Securities: ~110K, incl. account numbers
- Citizen Watch: ~100K (Citizen, Bulova, Frederique Constant)
- Cut off within ~12 hours
- Planned fixes: admin MFA, separating clients
https://japancyberwatch.com/articles/scala-communications-i-ask-breach-daiwa-citizen-2026
Rakuten Drive breach: attackers used a stolen administrator account to view and take files stored by 15,382 users over almost eight months (Jan 29 to Sep 17, 2026).
- Also: hashed passwords and salts for 313 accounts
- In July, fake "YOUR RAKUTEN DRIVE HACKED" push notifications reached users via the app
- On Aug 13, Rakuten Drive said no access to stored data had been confirmed
- No link between the two has been explained
https://japancyberwatch.com/articles/rakuten-drive-unauthorized-access-stored-files-2026
Japan detained a core Qilin ransomware member and extradited him to Germany, the Asahi Shimbun reports (unnamed sources, no official statement yet):
- Russian national, 28, said to build the group's systems
- Detained while traveling in Osaka in late May
- Handed to Germany on Oct 2
- German case: 2024 extortion of a logistics firm (~$165K)
- Not reported to be involved in the Asahi attack
https://japancyberwatch.com/articles/qilin-ransomware-member-detained-japan-extradited-germany-2026
Osaka Metropolitan University hit by ransomware:
- Attackers got into the virtualization platform; ~500 servers stopped
- Most backups encrypted; no recovery date
- All classes cancelled until Oct 8
- Data on 130,000+ students and graduates, back to 1995, under investigation
- University hospital unaffected
https://japancyberwatch.com/articles/osaka-metropolitan-university-ransomware-2026
Lawson, one of Japan's biggest convenience store chains, says a third party used its own mail server to send about 700,000 English-language scam emails over a weekend (Sep 25–27, 2026).
- Subjects: "Mutual Benefit" or "RE", offering money
- Mostly sent overseas
- Sender name disguised as someone else, so "check the sender" doesn't help
- No data leak confirmed. Cause not disclosed
https://japancyberwatch.com/articles/lawson-mail-server-abuse-spam-2026
Monitor law enforcement announcements regarding Qilin operations and indictments for further personnel changes at the organization.
Reward: You've received the Osaka Layover Debuff. It is permanent.
https://japancyberwatch.com/articles/qilin-ransomware-member-detained-japan-extradited-germany-2026
#Ransomware #Qilin #Cybercrime #Extradition #Japan #JusticeServed (3/3)