CasesS=1:500S=1:100
Ryomo Systems ransomware attack: the way in and the timeline
An outside third party misused an account on the company's VPN equipment to enter the internal network.
1 Summary
On August 12, 2026, an outside party used an account on Ryomo Systems' VPN equipment to enter its internal network. Early on August 14, internal monitoring flagged an anomaly, and the company cut the network. Outside specialists confirmed a ransomware attack. Sales, transaction and personal data may have leaked.
Probable cause: An outside third party misused an account on the company's VPN equipment to enter the internal network.
Source: Ryomo Systems 「当社社内システムへの不正アクセスに関するお知らせ（第3報）」 (Wayback Machine 2026-10-16)
The company's page was under maintenance when checked; the wording comes from its third report as archived on 2026-10-16.
S=1:100 2 Factual information
2.1 The way in
The company's third report: on August 12, 2026, "an outside third party misused an account on network connection equipment (VPN) and intruded into the internal network."
Source: Ryomo Systems 「当社社内システムへの不正アクセスに関するお知らせ（第3報）」 (Wayback Machine 2026-10-16)
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
Outside specialists confirmed a ransomware attack and found traces of unauthorized access on some servers.
2.3 Damage
Sales, transaction and personal data may have leaked, including data on clients' customers, businesses that contacted the company, individual customers and employees. The company is contacting the people affected.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2026-08-12 | Intruder | Misuses an account on the VPN equipment and enters the internal network. | Ryomo Systems |
| 2026-08-14 | Company | Early morning: internal monitoring detects an anomaly; cyberattack confirmed and network cut. | Ryomo Systems |
| 2026-08-15 | Company | First public notice; outside forensic investigation begins. | Ryomo Systems |
| 2026-09-25 | Company | Third report states the VPN account as the route. | ScanNetSecurity |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Entry was by misusing an account on the VPN equipment. | Stated | Ryomo Systems |
| Traces of unauthorized access were found on some servers. | Stated | Ryomo Systems |
| How the account was obtained, and whether multi-factor authentication was in place. | Unknown | Ryomo Systems |
S=1:100 4 Conclusions
The company's third report states that an outside party misused a VPN account to enter on August 12, and that the attack was detected by internal monitoring early on August 14.
S=1:100 5 Recommendations
The sources read for this page publish no list of measures.
Sources
Source: Ryomo Systems 「当社社内システムへの不正アクセスに関するお知らせ（第3報）」 (Wayback Machine 2026-10-16)ScanNetSecurity 「両毛システムズにランサムウェア攻撃」