A hacking group known as BlackSuit has claimed responsibility for the recent ransomware attack on publishing giant Kadokawa, and threatened to release stolen data if ransom is not paid by July 1, 2024.

BlackSuit is a notorious ransomware gang that emerged as a rebrand of the Royal ransomware operation. The group is believed to have ties to the now-defunct Conti cybercrime syndicate, a major player in the ransomware scene.

While the exact location and identities of the members remain unclear, cybersecurity experts have identified several indicators that suggest links to Russia.

Kadokawa first acknowledged the cyberattack in early June, reporting disruptions to multiple websites and services. Since then, the company has provided regular updates on its efforts to restore systems and investigate the incident.

However, The statement reported by BlackSuit on June 27, 2024 revealed the full extent of the breachalleging the theft of 1.5 terabytes of confidential information, including business plans, user data, contracts and financial records.

BlackSuit claims to have exploited vulnerabilities in Kadokawa's network architecture, gaining access to a "control center" that allowed them to encrypt the entire network, affecting several subsidiaries including Dwango and NicoNico.

Despite Kadokawa's IT department detecting their presence, the hackers were able to continue downloading data for several days before encrypting the network.

Hacker group claims Kadokawa is negotiating a deal but has offered an “extremely low” ransom for a company of its size. They warned that the leaked data could have significant consequences for Kadokawa's business operations and the privacy of many Japanese citizens.

The ransom was not specified in the statement. See the image of the statement below.

In its most recent updateKadokawa assured customers that no credit card information was compromised as it was not stored on its system.

The company also said its top priorities were restoring accounting functions and normalizing production and distribution in its publishing business, with results expected in early July.

While the production of new publications remains stable, the shipment of existing publications is currently at one-third of normal levels. To mitigate the impact, Kadokawa is implementing alternative measures, including increasing human resources.

In its Web Services business, all services in the Niconico family are still suspended, although interim services such as Niconico Video (Re: tmp) and Niconico Live Streaming (Re: tmp) have been provided.

Existing services such as the smartphone version of Niconico Manga and NicoFT have also been resumed.

The freight business saw limited impact, with shipping functions operating normally. However, a failure in Kadokawa's account authentication function prevented users from logging into certain online stores.

Temporary pages have been created for affected users. Kadokawa said it will continue to update on this issue.

Source: NHK, Kyodo