Cyber Incident Victim: Morinaga Milk Industry Co.
Date:
Jun 2018
Location:
Japan
Summary
A major Japanese dairy products company experienced unauthorized access to its health food shopping website, resulting in the theft of personal data affecting up to 92,822 customers. The breach compromised credit card information for approximately 29,773 individuals, with around 300 confirmed cases of fraudulent transactions totaling roughly ¥20 million in losses. An external investigation verified the scope of the incident and the illicit use of financial details.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 4, 2018, Morinaga Milk Industry Co., a major Japanese dairy products manufacturer, publicly disclosed a cybersecurity incident involving unauthorized access to its health food shopping website. The company confirmed that personal data belonging to up to 92,822 customers had been compromised through the breach. External investigators determined that credit card information for 29,773 affected individuals was specifically exfiltrated during the attack. The compromised payment card data subsequently led to confirmed fraudulent activity, with approximately 300 cases of illicit transactions totaling roughly ¥20 million (approximately $182,000 USD at 2018 exchange rates) identified at the time of disclosure. Morinaga Milk did not specify the exact timeframe of the intrusion but revealed these findings upon completing its forensic investigation.
The breach exposed customer information submitted through the company's e-commerce platform, though the announcement did not detail specific data elements beyond credit card details. Morinaga Milk acknowledged the operational impact through confirmed financial fraud while providing no evidence of broader system compromise beyond the health food website. The company's disclosure emphasized the external investigation's conclusions without describing intrusion methods, attacker origins, or detection timelines. No statements referenced system containment procedures or customer notification processes beyond the public announcement. Financial institutions and affected customers faced direct monetary consequences from the fraudulent transactions linked to the stolen payment data.