Ryomo Systems

Summary

Ryomo Systems detected unauthorized access to its internal systems and is investigating the scope and entry point of the intrusion while assessing whether any data was exfiltrated. The company has not confirmed a breach, identified the attackers, or received a ransom demand, and it states that it does not yet know if customer or third‑party information was compromised. As an IT provider that develops software and offers services to public administrations, utilities, healthcare, education and other sectors, the incident raises concern about possible exposure of credentials, configurations or source code that could affect its clients. It has activated its CSIRT and is working to determine which systems were accessed and to restore normal operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 14, 2026, Ryomo Systems detected unauthorized access to its internal systems and immediately began an investigation to determine the cause, entry route, and extent of the intrusion. The company stated that it is working to assess the impact of the incident and to recover its affected systems while maintaining its normal operations. Ryomo’s initial public statement emphasized that it had not yet confirmed whether any information leak had occurred and that it lacked conclusive details about the impact of the breach. As of the latest update, the responsible group has not been publicly identified, and there is no attribution to a ransomware operation, a state‑sponsored actor, or any ransom demand or threat of data publication.

Ryomo Systems, founded in 1970 and headquartered in Kiryu, Gunma Prefecture, operates as part of the Mitsuba group and provides software development, system sales, and information processing services to a broad range of sectors. Its client base includes public administrations, police forces, water utilities, schools, libraries, energy providers, manufacturers, logistics firms, printing companies, healthcare organizations, as well as data center, cloud, consulting, outsourcing, network, and maintenance services. The company’s 2026 corporate documentation highlights solutions for local government management, customer and accounting systems for water companies, network infrastructure, support for educational institutions, and services for the energy and medical sectors. Because Ryomo supplies technology that integrates with its clients’ environments, it represents a potential conduit for attackers seeking to access the systems, credentials, or data of those client organizations.

The article notes that the internal systems of an IT provider like Ryomo can contain a variety of valuable assets, including credentials, network configurations, technical documentation, source code, access keys, customer data, contracts, project information, backups, and details about the infrastructures it manages. It further explains that if the provider holds elevated permissions or maintains remote connections to client systems, an attacker who obtains those credentials could exploit the existing trust relationship to reach multiple targets without needing to compromise each individually. Another point of interest highlighted is the possible theft of source code and technical documentation, which could reveal application functionality, external components, configuration details, and potential vulnerabilities, drawing a parallel to the 2025 F5 incident where source code and vulnerability information were stolen. Ryomo has acknowledged in its own documentation that cyberattacks and the risk of information leakage constitute a threat to its business and states that it maintains information security management, data protection controls, and a CSIRT to respond to security incidents.

At present, Ryomo has not confirmed that personal data, customer information, or third‑party credentials were exfiltrated, nor has it verified that attackers accessed any client systems. The company continues to investigate whether an information leak occurred and, if confirmed, plans to disclose which specific systems were compromised, what data was accessed or taken, and whether any connections to client environments were established. The ongoing effort focuses on determining the full scope of the intrusion, securing affected systems, and preserving the integrity of the services it provides to its diverse customer base.

Sources

Sources available to members: 1 source.