Cyber Incident Victim: Toshiba Lifestyle Products & Services
Date:
Feb 2022
Location:
Japan
Summary
Toshiba Lifestyle Products & Services confirmed fraudulent emails impersonating its employees were distributed to multiple recipients, with sender names displaying employee identities but originating from unauthorized email addresses inconsistent with the company's legitimate "@toshiba-lifestyle.com" domain. The malicious emails posed risks of malware infection and unauthorized system access through embedded links or attachments. The company issued warnings advising recipients to delete suspicious messages without interaction and emphasized ongoing efforts to strengthen information security measures in response to the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around February 1, 2022, Toshiba Lifestyle Products & Services Corporation confirmed that suspicious emails impersonating its group employees had been sent to multiple recipients. The company publicly acknowledged the incident on February 17, 2022, issuing an apology for the concern and inconvenience caused to customers and stakeholders. The fraudulent emails displayed employee names in the sender field but originated from email addresses inconsistent with Toshiba Lifestyle Group's official "@toshiba-lifestyle.com" domain. This discrepancy between displayed sender names and actual email addresses served as a key indicator of the messages' illegitimate nature. The company warned that opening attachments or clicking links within these emails could potentially lead to computer virus infections or unauthorized access, specifically referencing the "Emotet" malware threat described in an attached cybersecurity advisory from Japan's Information-technology Promotion Agency.
In response to the incident, Toshiba Lifestyle Products & Services implemented immediate countermeasures including widespread awareness campaigns about identifying suspicious emails. The company formally advised recipients to delete unopened any emails claiming affiliation with their employees that originated from non-official domains. Organizational commitments were made to strengthen information security protocols, though specific technical enhancements were not detailed in public communications. No confirmed reports of successful malware infections or data breaches stemming from this campaign were disclosed in the company's statement. The incident prompted reinforced warnings about cybersecurity vigilance while highlighting the ongoing threat of business email compromise schemes targeting corporate identities. Toshiba's public response focused on transparency regarding the threat vector and procedural improvements to prevent similar occurrences.