Seiko Group Corporation (SGC) has recently confirmed the extent of a data breach that it disclosed initially in August. The company’s latest notice focuses on the security of 60,000 records.
The data breach notification, originally published on its website on August 10, resulted from unauthorized access detected on July 28 2023 after the ransomware gang BlackCat listed Seiko on its data leak site. The incident was reported to the Personal Information Protection Committee and the Tokyo Metropolitan Police.
“Following a comprehensive review by both the Company and cybersecurity experts, we confirmed that a total of approximately 60,000 items of personal data held by Seiko Group Corporation (SGC), Seiko Watch Corporation (SWC), and Seiko Instruments Inc. (SII) were compromised,” reads the latest version notice, updated earlier today.
The affected information includes:
-
SWC customer data
-
Counterparties’ contact details in business transactions
-
Applicant information for employment with SGC and SWC
-
Personnel details of current and former employees of SGC and its group companies
“Given the size of Seiko, some may say the company got off lightly, with BlackCat only managing to compromise 60,000 items of data. But, in reality, the impacts of this breach go far further,” commented Mike Newman, CEO of My1Login.
“With criminals now holding sensitive data belonging to customers, employees and job applicants, they can target these victims with realistic phishing scams to try to ensnare them further, which means other organizations may get caught up in the aftermath of this incident.”
Read more on BlackCat: New Ransomware Victims Surge by 47% with Gangs Targeting Small Businesses
Notably, credit card information remained secure. The company also enhanced security, including blocking external server communication, deploying EDR systems and implementing multi-factor authentication (MFA). In the future, they plan to work with cybersecurity experts to assess vulnerabilities, improve system security and prevent future incidents through measures like third-party assessments.
“We sincerely apologize for any inconvenience this attack on our data servers may have caused or may yet cause,” Seiko wrote. “We have begun reaching out to each of the affected parties individually, and if any further leaks are discovered, we will, to the best of our ability, continue to respond to each affected party on an individual basis.”
Image credit: Nor Gal / Shutterstock.com