Several blogs are reporting that the Underground ransomware gang stole 200 GB from Casio Computer Co. in Tokyo and disrupted its supply chain and operations. The posts are dated October 2026. We could not confirm a new incident. None of the eight sources we reviewed is a primary source: there is no Casio statement, no regulator filing and no CERT advisory. Every specific detail in the reporting (the 200 GB figure, the October 5 detection date, the October 10 leak-site post, the October 11 confirmation and the count of 8,478 affected people) matches the attack Underground carried out against Casio in October 2024, which Casio confirmed. One of the main sources also bundles Casio with several other October 2024 incidents and dates them all to 2026. Our assessment: this is very likely an old story with new dates on it, not a second attack. Unless Casio says otherwise, defenders should treat it that way.
What Happened
Three sources describe the incident directly, and all three are low-tier (OTHER) sites.
- Colibrisec (S1) gives a day-by-day timeline. Detection is on October 5. A crisis committee and shipping delays follow on October 7 and 8. Underground posts Casio on its leak site on October 10. Casio confirms the theft on October 11 and 12. S1 says Casio itself "confirmed" the attack. It links to no Casio statement.
- Shellcode (S2), dated October 5, 2026, describes ordering, shipping and support systems taken offline across Tokyo and overseas subsidiaries. It says the investigation involved JPCERT/CC. It offers no JPCERT advisory or Casio notice to back this up.
- Colibrisec's weekend roundup (S3) says Casio "confirmed a 200 GB data breach and logistics disruption by the Underground ransomware group."
Why we think it is recycled:
- The timeline matches 2024 exactly. In the real attack, Casio found the intrusion on October 5, 2024. Underground listed Casio on its leak site around October 10, 2024, and Casio confirmed data theft the next day. S1's 2026 timeline uses the same days, one for one.
- The victim count matches Casio's 2024 findings. S1 lists 8,478 affected individuals: 6,456 employees, 1,931 business partners and 91 customers. That is the breakdown Casio published after investigating the 2024 breach. An attack only days old would not have a finished, itemised victim count.
- The roundup around it is all 2024 news. S3 puts Casio next to the Internet Archive 31M breach, the Qualcomm FastRPC zero-day CVE-2024-43047, the Palo Alto Expedition flaws CVE-2024-9463 and CVE-2024-5910, Fidelity's 77,099-customer notice, ESET's GoldenJackal research and the American Water intrusion. Every one of these is an October 2024 event, and the CVE numbers carry 2024 dates. The whole roundup looks like 2024 content with 2026 dates.
- The sources from the real 2026 wave never mention Casio. TSN Media (S4), Japan Cyber Watch (S5), The Layman Security (S6) and The Once Times (S8) cover the genuine run of Japanese breaches in October 2026: Bookoff, skyticket, Resorttrust, Lawson, Daiichi Kosho, Times Car, H.I.S. and Asahi Kasei Therapeutics. S4 cites Kyodo reporting that "dozens of Japanese companies" disclosed intrusions "in recent days." S8 reports that Japan's National Cybersecurity Office issued an alert to businesses and the government held an emergency meeting. None of the four lists Casio, and a company of Casio's size being hit would almost certainly have been included.
- The one Japanese-language source refers to 2024. S7 is a personal blog post on note.com. It mentions "a ransomware attack on Casio Computer's systems in October 2024" (2024年10月). The post is mostly unsupported conspiracy claims, and its figures, including a loss estimate, should not be relied on. It does show that the attack Japanese readers remember is the 2024 one.
Verdict: accounts differ on when this happened, and no primary source supports a 2026 date. The evidence points to Underground's October 2024 attack on Casio being republished with new dates.
What Was Taken
What the recycled reporting says, and how far each claim can be trusted:
- Volume: all three Casio sources (S1, S2, S3) give 200 GB. That is the same amount Underground claimed in 2024.
- Data types: S2 lists vendor contracts, HR records, patent schematics and customer personal data. Only S2 makes these claims, and it does not attribute them to anyone. Treat them as unverified.
- People affected: S1 gives 8,478 (6,456 employees, 1,931 partners and 91 customers). This is Casio's final 2024 count, not a new figure.
- Consumer platforms: S1 says Casio kept its consumer cloud services isolated from the attack. Casio said something similar in 2024. The point is not independently confirmed for 2026.
We found no evidence that any data is newly exposed. If Underground has posted Casio again, it is most likely the 2024 dataset rather than a new theft.
Why It Matters
- Recycled stories waste incident response time. A redated breach story can lead to vendor-risk escalations, unneeded password resets and board briefings for something that was dealt with two years ago. Before acting, check the dates and look for primary sources.
- The real Japanese wave is still serious. Separately from Casio, Japan is dealing with a genuine series of disclosures in October 2026. Reports range from 2.1M+ Lawson ID records (S8) to up to about 6.43M Bookoff member records and about 14.64M skyticket records (S4). There are also about 8.72M Daiichi Kosho records at risk, held by a contractor (S6, S8), and up to 514,000 healthcare professionals exposed through Asahi Kasei Therapeutics' vendor (S5). The NCO named three causes: exploited web vulnerabilities, supply-chain compromise and weak data management (S8).
- Underground is still active. Even if this story is old, the group behind the 2024 Casio attack uses double extortion against manufacturers. S2's claim that the group shares code with Darkside and BlackMatter comes from one OTHER-tier source and is not corroborated here.
The Attack Technique
The sources do not establish how attackers got in.
- S1 lists "Phishing & Perimeter Access" as the way in, followed by encryption and data theft across the internal network. No other source corroborates this.
- S2 describes extensive lateral movement through hybrid server networks, data staged before exfiltration, and deleted volume shadow copies. These are typical of human-operated ransomware but are not specific to this case.
- Neither source names a CVE, a phishing lure or a compromised account.
The NCO's October 2026 alert (S8) relates to the wider wave, not to Casio. It highlights exploited internet-facing systems and contractor compromise. The Daiichi Kosho and Asahi Kasei cases (S5, S6) both came in through vendors.
What Organizations Should Do
- Confirm a breach before escalating it. Insist on a primary source: a victim statement, a regulator filing or a CERT advisory. Check the CVE years, the days of the week, and whether the victim counts look too complete for a new incident.
- Check leak-site claims against data you have already seen. When a known victim appears again, compare file trees and sample documents with earlier leaks before treating it as a new theft.
- Review contractor data holdings regularly, not just when the contract is signed. The NCO recommends this (S8). Find out how much of your customer data sits on contractor laptops and in vendor-run portals (S5, S6).
- Patch internet-facing systems quickly and require MFA. These are the NCO's first two recommendations, aimed at the most common entry points in the current wave.
- Keep ransomware recovery working. Keep offline, immutable backups. Watch for shadow-copy deletion and large outbound transfers. Rehearse manual fallbacks for ordering and logistics, because S1 and S2 describe exactly those processes stopping.
- Delete data you no longer need. The NCO advises deleting data once it has served its purpose and encrypting it at rest and in transit, which limits what a double-extortion gang can take.
Sources: Casio Computer Hit by Underground Ransomware: 200 GB Exfiltrated in... | Casio Computer Co. Enterprise Data Breach: "Unde Shellcode | Security Roundup: Internet Archive 31M Breach, Qualcomm FastRPC Zer... | Japan's Data-Breach Wave: Bookoff, Times Car, skyticket, Lawson, Re... | Asahi Kasei Therapeutics Data Breach: 514,000 Japanese Healthcare P... | Daiichi Kosho Breach: 8.7M Karaoke Records at Risk | 14.カシオ計算機破壊事件 Apple Intelligence Professional Edition(Japanese)｜柏井則彦 | Lawson, Big Echo, Book-Off breaches: what leaked, and what customer...