Strengthen Security After Unauthorized Access Incidents
Overview
Following a series of data theft incidents involving personal information, the National Cybersecurity Office of the Cabinet Secretariat and the Ministry of Health, Labour and Welfare are urging businesses and others to strengthen vulnerability management, authentication measures, data protection, and related safeguards. They call for comprehensive measures across the entire supply chain, including contractors, under the leadership of senior management. They also provide information for medical institutions, alerts from related organizations, and consultation services.
Key points
- Unauthorized access incidents involving the theft of data containing personal information have been confirmed in succession.
- Businesses and others are urged to promptly implement thorough measures across the entire supply chain, including contractors.
- Particular caution is urged for businesses that hold large volumes of personal information and those that handle sensitive information.
Overview
Incidents in which data containing personal information has been stolen through unauthorized access to the information systems of businesses and others that handle large volumes of personal information have been confirmed in succession. In response, the National Cybersecurity Office of the Cabinet Secretariat issued an alert to businesses and others, and the Ministry of Health, Labour and Welfare issued a similar alert to businesses under its jurisdiction and related organizations.
Impact
In the confirmed incidents, data containing personal information has been stolen through unauthorized access.
Details
Recommended measures include addressing vulnerabilities by applying security patches and updates, strengthening authentication measures such as multi-factor authentication, and ensuring data protection. Businesses and others are urged to further strengthen cybersecurity measures under the leadership of senior management and to promptly consider thoroughly implementing measures across the entire supply chain, including contractors. Medical institutions and providers of medical information systems are directed to refer to guidance from the Ministry of Health, Labour and Welfare, including “Cybersecurity Measures in the Medical Field.”
As reference information, the article points to the Personal Information Protection Commission’s “Response to Large-Scale Data Breach Incidents (Alert),” JPCERT/CC’s alert on unauthorized access affecting domestic organizations, and the IPA’s special consultation service for companies affected by unauthorized access. It also cites the National Cybersecurity Office’s “Response to Incidents Involving Leaks Due to Unauthorized Access” as a reference document.