Lessons Learned from Ransomware Incidents Published
Overview
A collection of lessons learned extracted from ransomware damage cases by the Information-technology Promotion Agency, Japan Security Center. It organizes the characteristics of intrusion-type ransomware attacks, management and risk management, and incident response for executives and incident response departments, with the aim of helping organizations prepare for future incidents and further enhance their incident response plans and business continuity plans (BCP).
Key points
- Intrusion-type ransomware attacks involve double extortion through the encryption of critical assets and the theft of information.
- When encryption is discovered, the attackers’ activities are already in their final stage, leaving the organization no time to spare.
- Emergency decisions by the information systems department, business departments, and management are required for breach investigation, recovery, business continuity, and external disclosure.
- Management’s understanding and involvement are extremely important in combating the threat of ransomware.
Overview
Ransomware attacks continue to occur frequently, regardless of the size of the organization. In current intrusion-type ransomware attacks, critical assets are encrypted and the stolen information is used as leverage for double extortion, making them a serious threat to organizations.
When encryption is discovered, the attackers’ activities are already in their final stage. With no time to spare, organizations must pursue multiple responses, including breach investigation, recovery, decisions on whether business can continue, and external disclosure.
This collection of lessons learned is based on interviews conducted by the Computer Virus and Unauthorized Access Reporting Desk with multiple organizations in Japan that suffered damage. It reviews the events and responses at the time of the incidents and organizes matters that could occur at other organizations as lessons learned.
Impact
This collection of lessons learned is expected to be used to prepare for ransomware incidents that may occur in the future.
It is presented as useful for further enhancing incident response plans and business continuity plans (BCP (Business Continuity Plan)).
Details
The document is titled “Lessons Learned from Ransomware Damage: A Ransomware Countermeasures Handbook for Executives.” It is presented by the Information-technology Promotion Agency, Japan Security Center.
The table of contents includes “Overview,” “Characteristics of Ransomware Incidents,” “Management and Risk Management,” “Incident Response,” and “Summary,” as well as “Reference: Examples of Ransomware Countermeasures in Public Documents” and “Related Information.” “Overview” contains “1.1 Background,” “1.2 Intended Readers,” “1.3 Structure,” and “1.4 Points to Note Regarding This Collection of Lessons Learned.”
The “Management and Risk Management” section covers “3.1 Rapid Management Decisions and Clear Involvement by Executives,” “3.2 Establishing an Incident Response Structure,” “3.3 Incorporating Measures into the Business Continuity Plan,” “3.4 Understanding the Current Status of Data Including Personal Information,” “3.5 Unifying Decisions Under Executive Leadership,” and “3.6 Preparing for the Exposure of Stolen Data.”
The “Incident Response” section covers “4.1 Ensuring the Integrity of Backups and Logs,” “4.2 Thoroughly Implementing Basic Countermeasures,” “4.3 Introducing EDR and Conducting Regular Log Audits,” “4.4 Difficulty Proving That There Was No Data Leakage,” and “4.5 Building Relationships with Security Vendors.”
The “Reference: Examples of Ransomware Countermeasures in Public Documents” section cites the IPA publication “Information Security Top 10 Threats 2026: Explanatory Book (Organizations)” and “NIST IR8374 Rev.1 Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile.”
The “Related Information” section provides related information, including the “Special Ransomware Countermeasures Page,” and contact details. Product names, service names, and other such names listed are trademarks or registered trademarks of their respective companies.