Chapter 4S=1:500S=1:100
Cases
How Asahi, ASKUL, Handa Hospital, Colonial Pipeline, Boeing and 10 more were entered, in their own or an official report's words. Nine name a VPN.
Before dawn on October 31, 2021, the printers at Handa Hospital in Tokushima began printing the same page, over and over: a statement that the hospital’s data had been stolen and encrypted.
Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)
Summary
In every case here, the organization or an official investigation stated how the intruder got in. Nine of the fifteen name a VPN appliance. Five say only “network equipment”, “communications equipment”, “remote connection device” or “connection point with external networks”, and this chapter keeps those words even where a government committee or a published article later pointed to a VPN. One names an outside contractor’s account and not the device it logged in to.
In the four hospital and port investigations, none of the devices’ own logs were available (at Nagoya they had never been collected), and three of the four devices accepted connections from anywhere on the internet.
The way in, by case
Index of cases
“Found” is the day the organization found the attack, or the day it went public where it never said. Impact is in the organization’s own terms.
| Organization | Way in | Product, CVE | Found | Impact | Sources |
|---|---|---|---|---|---|
| Japan | |||||
| Tsurugi Town Handa HospitalHospital, municipal, 120 beds | VPN | Fortinet FortiGate (VPN appliance for remote maintenance)CVE-2018-13379 | 2021-10-31 | Medical records down; normal care after about 2 months | Tsurugi Town Handa Hospital, expert panel on the computer virus incident [1] 徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 [2] 徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編 |
| Osaka General Medical CenterHospital, prefectural, acute care | VPN | Fortinet FortiGate at the catering contractorCVE-2018-13379 | 2022-10-31 | Core systems 43 days, full recovery 73 days | Osaka General Medical Center, Information Security Incident Investigation CommitteeOsaka General Medical Center investigation committee |
| Nagoya Harbor Transportation Association (NUTS terminal system)Port, container terminals | Remote connection device type undisclosedThe MLIT committee reads it as the maintenance VPN appliance, without concluding definitively | — | 2023-07-04 | All terminals stopped for about 2.5 days | Nagoya Harbor Transportation AssociationMinistry of Land, Infrastructure, Transport and Tourism |
| Okayama Psychiatric Medical CenterHospital, prefectural, psychiatric | VPN | Cisco ASA 5506-X (SSL-VPN for maintenance) | 2024-05-19 | Up to 40,000 people's data leaked; about 3 months to recover | Software ISAC, Okayama Psychiatric Medical Center investigation committee |
| Kantsu Co., Ltd.Logistics outsourcing | Connection point with external networks type undisclosedA SoftBank blog article writes that it was the VPN; the company's notices do not say so | — | 2024-09-12 | All servers rebuilt; shipments stopped or delayed | Kantsu Co., Ltd.SoftBank Corp. business blog |
| ASKUL CorporationOffice supplies, e-commerce and logistics | Access from outside device not named | — | 2025-10-19 | Web orders stopped for about 6 weeks; about 740,000 records leaked | ASKUL Corporation |
| Asahi Group HoldingsBeverages and food | Network equipment type undisclosed | — | 2025-09-29 | Orders and shipping stopped; about 2 months to contain and restore | Asahi Group Holdings [1] サイバー攻撃による情報漏えいに関する調査結果と今後の対応について [2] サイバー攻撃被害の再発防止策とガバナンス体制の強化について |
| Anabuki Kosan Inc.Real estate | Communications equipment type undisclosed | — | 2026-02-03 | Personal and internal data on a leak site | Anabuki Kosan Inc. |
| YCC Information SystemIT services for local governments and companies | Network equipment type undisclosed | — | 2026-04-02 | File server encrypted; client data possibly accessed | YCC Information System |
| Seidensha ElectronicsManufacturing, industrial equipment | VPN | — | 2026-04-22 | Most servers encrypted; directory data taken | Seidensha Electronics |
| Ryomo SystemsIT services | VPN | — | 2026-08-14 | Sales, transaction and personal data possibly leaked | Ryomo SystemsScanNetSecurity |
| Outside Japan | |||||
| Colonial Pipeline CompanyFuel pipeline | VPN | — | 2021-05-07 | Pipeline shut for about 5 days | US Senate Committee on Homeland Security and Governmental AffairsBankInfoSecurity |
| Boeing Distribution Inc.Aircraft parts and distribution | VPN | Citrix NetScaler ADC / GatewayCVE-2023-4966 | 2023-11-02(disclosed) | Parts and distribution business affected | CISA, FBI, MS-ISAC, ASD's ACSCTechCrunch |
| US CISA, Chemical Security Assessment ToolGovernment cybersecurity agencyNot ransomware. CISA did not name the actor. | VPN | Ivanti Connect SecureCVE-2023-46805CVE-2024-21887 | 2024-01-26 | Two systems taken offline; no exfiltration found | CISA [1] Chemical Security Assessment Tool (CSAT) Ivanti Notification [2] ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure VulnerabilitiesCybersecurity Dive |
| MITRE Corporation (NERVE research network)Nonprofit researchNot ransomware. MITRE attributes it to a Chinese nation-state actor. | VPN | Ivanti Connect SecureCVE-2023-46805CVE-2024-21887 | 2024-04(disclosed) | Research network compromised (espionage, not ransomware) | MITREHelp Net Security |
How the cases were chosen
A case is here only if the organization or an official report named the way in. Incidents where the route is known only from press reports, security researchers or the attackers’ own claims are left out, even when often cited as VPN cases. Credentials quoted in the reports are not reproduced.
| Way in, as the organization stated it | Japan | Outside Japan | Total |
|---|---|---|---|
| VPN appliance | 5 | 4 | 9 |
| Device or connection point type undisclosed | 5 | 0 | 5 |
| Account only device not named | 1 | 0 | 1 |
| Total | 11 | 4 | 15 |
2 of these are not ransomware (intrusions into a US government agency and a research organization).
The case pages follow the Japan Transport Safety Board’s accident reports, which state that an investigation is meant to prevent the next accident and not to assign blame.