CasesS=1:500S=1:100
Kantsu ransomware attack: the way in and the timeline
The intruder came in through the company's connection point with external networks; the company has not said what that device was.
1 Summary
From about 18:00 on September 12, 2024, Kantsu's systems went down one after another, starting with attendance. Staff found the servers encrypted and a ransom note. The company disconnected the servers that night, and the next night decided to discard the whole environment and rebuild. Client shipments stopped or were delayed. The company says the intrusion came through its connection point with external networks.
Probable cause: The intruder came in through the company's connection point with external networks; the company has not said what that device was.
Source: Kantsu Co., Ltd. 「【第3報】当社におけるサイバー攻撃によるシステムの停止事案発生のお知らせ」
The company's notice says only "connection point with external networks". An article on SoftBank's business blog (2025), based on an interview with Kantsu's IT department, writes in its own narration that preliminary forensics found a server intrusion through leaked VPN credentials. The company's own notices do not say VPN.
S=1:100 2 Factual information
2.1 The way in
The company: "this incident was an intrusion from the connection point with external networks"; the attacker entered several servers from outside and encrypted them.
Source: Kantsu Co., Ltd. 「【第3報】当社におけるサイバー攻撃によるシステムの停止事案発生のお知らせ」
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
The attacker entered several servers and encrypted them. The company built a new environment separate from the damaged one, added continuous monitoring, and had an outside security firm check it before resuming work. About 450 PCs and the servers were replaced.
2.3 Damage
Shipments for client brands stopped or were delayed. The SoftBank blog article says the inventory system felt largely restored about a month and a half later.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| c. 2024-09-12 18:00 | Company | Systems fail, starting with attendance; servers found encrypted and a ransom note found. | SoftBank Corp. business blog |
| 2024-09-12 | Company | That night, servers physically disconnected from the network. | SoftBank Corp. business blog |
| 2024-09-13 | Company | First public notice. That night, decides to discard everything and rebuild. | Kantsu Co., Ltd. |
| 2024-09-20 | Company | A cloud attendance system goes live. | SoftBank Corp. business blog |
| 2024-09-28 | Company | Third report: intrusion from the connection point with external networks. | Kantsu Co., Ltd. |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| The intrusion came from the connection point with external networks into several servers. | Stated | Kantsu Co., Ltd. |
| A SoftBank blog article based on an interview with the IT department writes that preliminary forensics, about two weeks in, found leaked VPN credentials to be the cause. This is the article's narration, not a quoted statement. | Presumed | SoftBank Corp. business blog |
| What device the connection point was, and whether credentials or a vulnerability were used. The company has not said. | Unknown | Kantsu Co., Ltd. |
S=1:100 4 Conclusions
The company states that the intrusion came through its connection point with external networks and that several servers were encrypted. It has not named the device or published an investigation report. A SoftBank blog article based on an interview with its IT department attributes the cause to leaked VPN credentials.
S=1:100 5 Recommendations
Recommended or carried out by: Company
- Rebuild in a new environment, separate from the damaged one, with continuous monitoring.
- Have an outside security firm check the new environment before resuming work.
- Share the prevention measures with outsourcing partners.
Source: Kantsu Co., Ltd. 「【第3報】当社におけるサイバー攻撃によるシステムの停止事案発生のお知らせ」
Sources
Source: Kantsu Co., Ltd. 「【第3報】当社におけるサイバー攻撃によるシステムの停止事案発生のお知らせ」SoftBank Corp. business blog 「サイバー攻撃の教訓～関通 情シスが語る、全て捨てて挑んだ再構築。防御から復旧へ～」