Nippon Telegraph & Telephone

Summary

The incident involved unauthorized access to internal systems belonging to NTT Communications Corporation, discovered when the Information Security Department identified suspicious logs in communications to a device within the internal order information distribution system. Initial containment measures were implemented on the day of detection, followed by further investigation that revealed potential data leakage and additional unauthorized access to another internal device, which was subsequently blocked. The potentially leaked information pertains to corporate customers, including approximately 17,891 companies, and may include contract numbers, customer and contact names, telephone numbers, email addresses, physical addresses, and service-related information. No data regarding individual customers was involved, and no cases of misuse of the exposed information had been confirmed at the time of disclosure.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 5, 2019, NTT Communications Corporation (NTT Com) detected suspicious activity within its internal network. The company's Information Security Department identified anomalous logs in communications directed at Device A, which was part of the Order Information Distribution System used internally to manage and distribute information related to the launch and modification of corporate customer services. Upon detection, NTT Com acted on the same day by implementing initial containment measures, restricting access to Device A in order to limit further unauthorized interaction with the system. The discovery was later publicly disclosed by NTT Communications on March 5, 2025, in a press release explaining the sequence of events and the company's response.

A detailed internal investigation was launched following the initial detection. Analysis of communication logs for Device A and surrounding systems revealed, on February 6, 2019, that some information stored within the Order Information Distribution System may have been leaked to an external party. As the investigation progressed, NTT Com determined that additional unauthorized access had occurred, this time involving Device B on the internal network, on February 15, 2019. On that same day, the company took action to block Device B from the internal network, removing the compromised device from the environment to halt further unauthorized activity. The public disclosure noted that initial measures were implemented on February 5 and that the device-level block was executed on February 15.

The potentially impacted data was confined to information related to services provided to corporate customers. NTT Com confirmed that information about services for individual customers was not involved in the incident. The potentially leaked information included contract numbers, customer names (contract names), the names of customer contacts, telephone numbers, email addresses, physical addresses, and information related to the use of services. The number of corporate customers whose information may have been affected was reported as 17,891 companies. The notice specifically excluded smartphone and mobile phone contracts held under corporate names that were provided by NTT Docomo Inc., clarifying that those contracts were not part of the affected services. NTT Com stated that customers who might have been impacted would be contacted individually, either by sales staff or by letter, in the order of occurrence, and that no email communications would be sent regarding the matter.

At the time of the disclosure, NTT Com reported that no cases of unauthorized use of the potentially leaked customer information had been confirmed. The company also established a dedicated contact channel, the NTT Communications special hotline, with reception hours on weekdays from 9:00 to 17:00, and provided a contact form for inquiries. NTT Com expressed apologies to its customers and all concerned parties for the inconvenience and concern caused by the incident, and committed to continuing the strengthening of its security measures and monitoring systems to prevent recurrence, as well as improving the quality of its services. The company indicated that any new findings would be promptly disclosed, while refraining from disclosing information about individual customers due to confidentiality considerations.

Sources

Sources available to members: 1 source.