ITO EN Faces Ransomware Breach by Play Group
Ransomware Attack on ITO EN: A Detailed Analysis
ITO EN, a leading multinational company in the non-alcoholic beverage sector, has recently fallen victim to a ransomware attack allegedly orchestrated by the notorious Play ransomware group. This incident highlights the vulnerabilities even well-established companies face in the evolving landscape of cyber threats.
About ITO EN
Established in 1966 and headquartered in Shibuya-ku, Tokyo, Japan, ITO EN is renowned for its extensive range of tea products, particularly green tea. The company is the largest green tea distributor in Japan and the fourth-largest soft drink producer in the country. With a workforce of over 5,200 employees, ITO EN operates globally, with subsidiaries in North America, Asia, and Australia. Its commitment to quality and sustainability has made it a standout in the beverage industry.
Attack Overview
The Play ransomware group claimed responsibility for the attack on December 2, 2024, targeting file servers at ITO EN's North American subsidiary in Texas. The group reportedly exfiltrated sensitive data, including personal information, client documents, payroll records, and financial data. Despite the breach, ITO EN managed to isolate the compromised servers and restore data using pre-attack backups, ensuring minimal disruption to its operations.
About Play Ransomware Group
Emerging in June 2022, Play ransomware, also known as PlayCrypt, is recognized for its sophisticated techniques and targeted campaigns. Unlike affiliate-based RaaS groups, Play maintains a closed operational structure, enhancing its secrecy and precision. The group is known for its intermittent encryption technique, which complicates detection and accelerates the encryption process. In 2024, Play collaborated with APT 45, a North Korean state-sponsored group, to incorporate advanced techniques in its operations.
Potential Vulnerabilities
Play ransomware's ability to exploit vulnerabilities such as ProxyNotShell and authentication bypass flaws in VPNs could have facilitated the breach at ITO EN. The company's extensive global operations and reliance on digital infrastructure may have presented an attractive target for the group. Despite the attack, ITO EN's swift response and effective backup systems helped mitigate the impact, underscoring the importance of preparedness in cybersecurity.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!