Japanese media giant investigates further reported data loss by BlackSuit hackers

A major Japanese media company known for producing manga, anime and video games is still investigating a cyberattack on its systems after reports emerged that a ransomware group leaked new company information on the dark web.

Kadokawa was the target of a ransomware attack in June. In a statement on Tuesday, the company said it “continues to work diligently to fully restore its operations.”

Several researchers observed that the BlackSuit ransomware gang, which claimed responsibility for the attack, uploaded new data allegedly stolen from Kadokawa to its darknet site earlier this week.

🚨Update on cyber attack warning ‼️

🇯🇵Japan – KADOKAWA

The Black Suit ransomware group is sharing the exfiltrated files from KADOKAWA again, this time with additional data, as shown by the upload date of September 10.

Last August, the cybercriminal group warned the company that … pic.twitter.com/pWi03OBjoR

— HackManac (@H4ckManac) 10 September 2024

“We have confirmed that the organization that claimed responsibility for the attack has additionally claimed to have released some of our group's information,” Kadokawa said. “We are investigating this matter with the assistance of law enforcement and external security experts.”

There are currently no indications of new cyberattacks on the company's systems, the statement said. Kadokawa has not confirmed whether BlackSuit is actually behind the attack and has not responded to requests for comment.

BlackSuit began releasing small snippets of data allegedly stolen from Kadokawa in late June, threatening to release the remaining 1.5 terabytes of company files if the company did not pay a ransom.

BlackSuit is a renaming of the ransomware group Royal, whose operators presumably belong to the now-defunct cybercrime gang Conti.

Kadokawa had previously stated that the leaked data included information from business partners such as contracts and other documents, as well as internal company data including personal information of all employees of its subsidiary Dwango, which operates the popular Japanese video-sharing site Niconico.

In a new statement, Kadokawa claimed that the recently released information was probably “not new,” but added that it would further investigate it with the help of “external experts.”

“We deeply apologize for the significant distress and inconvenience the attack has caused,” the company added.

Kadokawa operates various businesses in the film, publishing and gaming industries. The company operates a Japanese e-book store called BookWalker, which sells manga, novels and magazines from various publishers, and also holds a majority stake in FromSoftware, the developer of the popular video game Elden Ring.

The cyberattack in June affected most of the operations of Kadokawa and its subsidiary because they were hosted in the same data center.

Learn more.