Japan Times Group Confirms Ransomware Attack; Data Claimed Stolen Appears Online
Summary
The Japan Times group said it confirmed a ransomware attack on Sept. 18 targeting an administrative file server last used in August 2022. Data attackers claimed to have stolen appeared online Oct. 15; its contents and scope remain under review.
Key points
- The group said it confirmed a ransomware attack on Sept. 18 and found data attackers claimed to have stolen published on an external website on Oct. 15.
- The targeted administrative file server was last used in August 2022.
- The server may have held personnel information from 2001 to August 2022 and information about business partners; the specific contents and affected people are not yet known.
- The group is comparing the published data with help from external specialists and plans to contact affected partners and individuals as they are identified.
- The group said its online edition, subscriber database and payment systems run on separate infrastructure.
- The article highlights the risk of retaining unused data and recommends checking that deletion includes logs, backups and other copies.
Article Details
- Victim Organization
- The Japan Times and News2U Holdings
- Incident Type
- Ransomware attack and unauthorized access to a group-managed administrative file server; attackers claimed to have stolen data, which was later found published on an external website.
- Incident Date
- 2026-09-18
- Disclosure Date
- 2026-10-02
- Data Types Exposed
- Potentially, personnel-related information from 2001 through August 2022
- Potentially, business partner information
- Affected Records
- Unknown; the specific individuals and scope had not been determined.
- Affected Data Size
- Unknown; no volume was reported.
- Operational Impact
- The affected server had been used by the administrative department until August 2022. The electronic edition, subscriber database, and payment system were on separate infrastructure; no impact to those systems or interruption to newspaper publication or website service was reported.
- Ransom Or Extortion
- The attackers claimed to have stolen data, and its publication on an external website was confirmed. The article does not report a specific ransom demand or payment.
- Claim Status
- claimed