CasesS=1:500S=1:100
YCC Information System ransomware: the way in and timeline
The administrator credentials of a network device were guessed or obtained, and used to enter the internal network; the device type has not been disclosed.
1 Summary
Early on April 2, 2026, YCC Information System found files on its file server encrypted and a ransom note. Encryption had begun at about 06:50. The file server held data entrusted by client organizations, so access to it cannot be ruled out. Investigators presume entry with a network device's administrator credentials.
Probable cause: The administrator credentials of a network device were guessed or obtained, and used to enter the internal network; the device type has not been disclosed.
Source: YCC Information System 「【重要】ランサムウェア攻撃に関するお知らせ（第五報）」
The company says "network equipment" and does not name the type or mention a VPN.
S=1:100 2 Factual information
2.1 The way in
The company, citing outside investigators: the incident is presumed to have happened because "the credentials of a network device's administrator account were guessed or obtained through the attacker's authentication attempts and other means," and used to enter the internal network.
Source: YCC Information System 「【重要】ランサムウェア攻撃に関するお知らせ（第五報）」
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
Files on the file server were encrypted and could not be opened. Mail, other systems and business PCs ran in a separate environment and showed no effect. Access to client data on the server cannot be ruled out, but no clear trace of data being sent outside was found.
2.3 Damage
Client organizations were told their entrusted data may have been accessed. No leak has been confirmed as of the fifth report.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| c. 2026-04-02 06:50 | Intruder | Encryption of files begins. | YCC Information System |
| c. 2026-04-02 07:50 | Company | Encrypted files and a ransom note found on the file server. | YCC Information System |
| 2026-04-03 | Company | First notice. | YCC Information System |
| 2026-05-20 | Company | Fifth report: presumed entry with a network device's administrator credentials. | YCC Information System |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Entry with a network device's administrator credentials, guessed or obtained by the attacker. | Presumed | YCC Information System |
| The type of network device, and whether data left the company. | Unknown | YCC Information System |
S=1:100 4 Conclusions
The company, based on outside investigators, presumes that the attacker used a network device's administrator credentials to enter and then encrypted the file server.
S=1:100 5 Recommendations
Recommended or carried out by: Company
- Overhaul the internet connection environment.
- Strengthen network operations monitoring, including outside specialists.
- Tighten security for data storage and data handling.
- Train and drill all staff, including executives.
Source: YCC Information System 「【重要】ランサムウェア攻撃に関するお知らせ（第五報）」
Sources
Source: YCC Information System 「【重要】ランサムウェア攻撃に関するお知らせ（第五報）」