CasesS=1:500S=1:100
Anabuki Kosan ransomware attack: the way in and the timeline
An attacker exploited a vulnerability in the company's communications equipment to get into the internal network; the equipment type has not been disclosed.
1 Summary
On February 3, 2026, Anabuki Kosan's monitoring detected a ransomware attack and encryption. The company cut the affected equipment off from the internal network and the internet. Part of its personal and internal data was later confirmed on a dark-web leak site; customer, job-candidate and staff data may have leaked. Outside investigators traced the entry to a vulnerability in the company's communications equipment.
Probable cause: An attacker exploited a vulnerability in the company's communications equipment to get into the internal network; the equipment type has not been disclosed.
Source: Anabuki Kosan Inc. 「情報流出に関するお知らせとお詫び（ランサムウェア被害発生のお知らせ（第４報））」 (pp.1–2)
The company says "our communications equipment" and does not name the type.
S=1:100 2 Factual information
2.1 The way in
The company: outside investigators found that "unauthorized access to the internal network was made by an attack exploiting a vulnerability in our communications equipment."
Source: Anabuki Kosan Inc. 「情報流出に関するお知らせとお詫び（ランサムウェア被害発生のお知らせ（第４報））」 (pp.1–2)
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
Mainly outside business hours, the intruder tried to log in to several servers with Remote Desktop and similar tools, took administrator rights, spread across the whole network and deployed ransomware to several servers. Personal and internal data was confirmed on a dark-web leak site.
2.3 Damage
Personal data of some real-estate customers, mid-career job candidates and current and former staff may have leaked. Much of the company's own data is encrypted, so the scope and count are still unclear.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2026-02-03 | Company | Monitoring detects a ransomware attack and encryption; affected equipment cut off. | Anabuki Kosan Inc. |
| 2026-04-03 | Company | Fourth report: data leak confirmed; entry through a vulnerability in its communications equipment. | Anabuki Kosan Inc. |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Entry was by exploiting a vulnerability in the company's communications equipment. | Stated | Anabuki Kosan Inc. |
| The type of equipment, the CVE, and the date of entry. | Unknown | Anabuki Kosan Inc. |
S=1:100 4 Conclusions
The company states that the intrusion exploited a vulnerability in its communications equipment, and that the intruder then took administrator rights and encrypted several servers.
S=1:100 5 Recommendations
Recommended or carried out by: Company
- Replace the existing infrastructure entirely and move from on-premises to a cloud-native base.
- Introduce a zero-trust architecture and an identity-management platform.
- Have outside specialists verify the measures on a continuing basis.
Source: Anabuki Kosan Inc. 「情報流出に関するお知らせとお詫び（ランサムウェア被害発生のお知らせ（第４報））」 (pp.1–2)
Sources
Source: Anabuki Kosan Inc. 「情報流出に関するお知らせとお詫び（ランサムウェア被害発生のお知らせ（第４報））」 (pp.1–2)