Asahi admits ransomware gang may have spilled almost 2M people's data

Asahi has finally done the sums on September's ransomware attack in Japan, conceding the crooks may have helped themselves to personal data tied to almost 2 million people. Back on September 29, Asahi disclosed a "system failure caused by a cyberattack" that knocked out ordering, shipping, and call center systems across its …

[spold]

Setsunai

Harakiri Friday for management I guess....

[Doctor Syntax]

Did a brewery really need to hold personal data on 2million people?

[MachDiamond]

"Did a brewery really need to hold personal data on 2million people?"

It has value and can be sold/rented at a profit. Since there's little downside even if it is stolen, why not?

If there's ever a time when a data breach has the possibility of ending a company and its directors, that's when they'll stop to consider whether holding the data is more trouble than it's worth. Until then, fines are just a cost of doing (very profitable) business.

[Tron]

Data is a risk not an asset.

Your intranet, infrastructure and any data stash should never touch the public internet. Treat your internet-connected systems as inherently unsafe and disposable. Two networks, air-gapped with people. The best security is physical security, by design, not software or infosec staff.

Forget SaaS, the cloud and AI and concentrate on protecting your core systems by ensuring they never touch the public internet.

[Kurgan]

Re: Data is a risk not an asset.

While you are right about air gapping critical systems and data, it still makes NO SENSE to keep the data of people who contacted the customer service. This is what's really wrong with this situation.