Nippon Swagelok FST Says Ransomware Attack May Have Exposed Employee and Business Contact Data
Summary
Nippon Swagelok FST says a March ransomware attack may have exposed personal information belonging to employees, former employees, and business contacts. The company has not disclosed the number affected; no secondary misuse was known as of August 26.
Key points
- The company said unauthorized access and a ransomware attack affected some servers on March 10, 2026, disrupting operations, including orders and shipments.
- Shipments resumed on March 17, with orders and quotations resuming on March 23.
- An external forensic investigation found that some personal information was leaked or may have been exposed; the number of people affected was not disclosed.
- Potentially affected data includes employee and former-employee contact details and some family information, as well as contact details for current and prospective business partners.
- As of August 26, the company said it had not confirmed fraud or other secondary harm using the potentially affected information.
- The company reported resetting all account passwords, requiring MFA for remote access, and establishing 24-hour monitoring; it did not disclose the entry method, ransomware identity, or attacker.
Article Details
- Victim Organization
- 日本スウェージロックFST株式会社
- Incident Type
- External unauthorized access and ransomware attack affecting some servers
- Incident Date
- 2026-03-10
- Disclosure Date
- 2026-08-26
- Data Types Exposed
- Names, addresses, and telephone numbers of current and former employees
- Names and contact details of employees' family members as held during employment
- Names, employer or organization names and addresses, email addresses, and telephone numbers of business partners' and potential business partners' contacts
- Affected Records
- Not disclosed
- Operational Impact
- Telephone, email, and fax services were unavailable, and all business operations, including orders and shipments, stopped from March 10. Shipments resumed gradually from March 17; orders and quotations resumed gradually from March 23. The company later reported that some personal information was leaked or may have been leaked. No secondary fraud or other misuse of the information had been confirmed as of August 26.
- Ransom Or Extortion
- Whether a ransom demand was made or paid was not disclosed. The article says the available information does not establish double extortion.
- Claim Status
- confirmed