CasesS=1:500S=1:100
Seidensha Electronics ransomware: the way in and timeline
A third party came into the internal network through the VPN and stayed two weeks before encrypting.
1 Summary
At 07:50 on April 22, 2026, Seidensha Electronics found unauthorized access by malware and cut its whole network. Most servers and several PCs had been encrypted. The intruder had come in through the VPN two weeks earlier, on April 8. Quoting, orders, production and shipping resumed on a temporary system from May 18.
Probable cause: A third party came into the internal network through the VPN and stayed two weeks before encrypting.
Source: Seidensha Electronics 「サイバー攻撃に関するお知らせ」
S=1:100 2 Factual information
2.1 The way in
The company: "On April 8, 2026, a third party intruded into the internal network from the VPN."
Source: Seidensha Electronics 「サイバー攻撃に関するお知らせ」
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
The intruder logged in to the Active Directory server, where employees' credentials were presumably taken, then logged in to several servers and PCs and encrypted them. Data on the Active Directory server is judged to have been transferred outside.
2.3 Damage
Most servers and several PCs were encrypted. The existing internal network has been cut off since April 22, including the VPN appliance the attack came through. Business resumed on a temporary system from May 18.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2026-04-08 | Intruder | Enters the internal network from the VPN. | Seidensha Electronics |
| 2026-04-22 | Intruder | Logs in to several servers and PCs and encrypts them. | Seidensha Electronics |
| 2026-04-22 07:50 | Company | Unauthorized access by malware confirmed; whole network cut. | Seidensha Electronics |
| 2026-04-22 10:00 | Company | Emergency headquarters set up with an outside security firm. | Seidensha Electronics |
| 2026-05-07 | Company | Incident made public. | Seidensha Electronics |
| 2026-05-18 | Company | Quoting, orders, production and shipping resume on a temporary system. | Seidensha Electronics |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Entry was from the VPN on April 8; encryption came on April 22. | Stated | Seidensha Electronics |
| Employees' credentials were taken on the Active Directory server. | Presumed | Seidensha Electronics |
| Whether the VPN was passed with credentials or through a vulnerability. | Unknown | Seidensha Electronics |
S=1:100 4 Conclusions
The company states that a third party entered from the VPN on April 8, logged in to the Active Directory server, where employees' credentials were presumably taken, and encrypted most servers on April 22.
S=1:100 5 Recommendations
Recommended or carried out by: Company (measures taken)
- Cut off the existing internal network and the VPN appliance the attack came through.
- Install EDR on PCs found uninfected and start round-the-clock outside monitoring (SOC).
- Isolate a PC and cut its network at once if malware is detected.
Source: Seidensha Electronics 「サイバー攻撃に関するお知らせ」
Sources
Source: Seidensha Electronics 「サイバー攻撃に関するお知らせ」