top of page
tech360.tv

Fujitsu Data Breach: Japan Government Orders Company to Take Corrective Action

Updated: Jan 5

Japanese authorities demand action from Fujitsu following data breaches affecting 1,700 companies and government agencies due to poor governance and delayed detection.

Fujitsu
Credits: Ami Yamada

Japanese authorities have instructed Fujitsu to implement corrective measures after the hacking of its cloud service resulted in data leaks affecting a minimum of 1,700 companies and government agencies. The Ministry of Internal Affairs and Communications attributed the breaches to inadequate governance, blaming Fujitsu for taking eight months to discover the hack. The breaches occurred between March and November of the previous year before being detected in December.


Highlighting significant issues with security measures, the supervisory mechanism and risk management, an official from the communications ministry expressed deep regret over the multiple leaks. The compromised cloud-based Fenics internet service, utilised by government agencies and corporations, was responsible for the security breach. The breach was a result of a configuration mistake made by Fujitsu, who failed to detect unauthorised access.

Notably, Fujitsu had already experienced cyberattacks on two other cloud services since 2021. Despite implementing prevention measures following those attacks, the company was still vulnerable when the attack on Fenics occurred. Senior officials at Fujitsu were unaware of the details of these incidents, indicating unclear authority within the internal committee responsible for preventing recurrences and inadequate governance.


Government officials suspect the involvement of hacker groups affiliated with the Chinese government in all three attacks, as Fujitsu develops critical infrastructure and systems for government agencies. Consequently, the government has decided to take administrative action, marking the first instance of guidance being issued based on the Telecommunications Business Act in response to cyberattacks. The act allows the ministry to intervene when the secrecy of communications, protected by Japan's constitution, is deemed at risk.


The government has been urging companies to enhance their cybersecurity measures and warning of potential liabilities for damages resulting from insufficient protection of data. Japanese companies have been experiencing an increasing number of cyberattacks, with an average of 1,018 attacks per company per week between January and March of this year—an uptick of 17% compared to the previous year, according to Check Point Software Technologies.

Additionally, there are deficiencies in the government's ability to monitor potential threats. While Fujitsu's Fenics service is part of Japan's Information System Security Management and Assessment Program (ISMAP), which evaluates the safety of cloud services, it does not meet the current criteria for auditing services that come under attack.


Overseas authorities have also taken action against weak cybersecurity practices in companies. The U.S. Securities and Exchange Commission recently indicated the possibility of civil enforcement action related to a significant 2020 data leak that impacted approximately 100 private and government organisations.


During a general shareholders meeting, Fujitsu CEO Takahito Tokita expressed his deep apologies and the shareholders' profound concerns regarding the cyberattacks. However, he has yet to hold a separate news briefing to address the implications of these attacks.


Despite expecting a record net profit for the second consecutive fiscal year in 2023, Fujitsu's cybersecurity vulnerabilities may cast doubt on its long-term performance as confidence wavers.

 
  • Fujitsu instructed to take corrective measures following data breaches affecting 1,700 companies and government agencies.

  • Poor governance and delayed detection attributed to the breaches.

  • Multiple leaks occurred due to significant security, supervisory and risk management issues.

Source: NIKKEI ASIA

As technology advances and has a greater impact on our lives than ever before, being informed is the only way to keep up.  Through our product reviews and news articles, we want to be able to aid our readers in doing so. All of our reviews are carefully written, offer unique insights and critiques, and provide trustworthy recommendations. Our news stories are sourced from trustworthy sources, fact-checked by our team, and presented with the help of AI to make them easier to comprehend for our readers. If you notice any errors in our product reviews or news stories, please email us at editorial@tech360.tv.  Your input will be important in ensuring that our articles are accurate for all of our readers.

bottom of page