The Japan Times, Ltd. and its parent, News2u Holdings, Inc., have confirmed that a server managed by the group was hit by ransomware. Data the attackers say they stole is now on an external website. In a second update, published in Japanese on October 16 and in English on October 19, the group said it confirmed the attack on September 18, 2026. On October 15 it found allegedly stolen data published online. The affected machine is an administrative file server that the group stopped using in August 2022. According to the company, it may hold HR records and business partner information from 2001 to August 2022. The company has not given a record count or the number of people affected. It says the content and scope of the published data "have not yet been fully identified." A ransomware group called Eclipse has claimed the attack, according to Japan Cyber Watch. The company's statements do not name any group.
What Happened
The Japan Times first disclosed the incident on October 2, 2026. It said only that "some servers managed by a group company" had been accessed without authorization, and that it was still investigating whether data had leaked. Japan Cyber Watch noted that the first notice never used the word "ransomware," although the web addresses of both language versions contained "ransomware-incident."
The second update, issued jointly by The Japan Times and News2u Holdings, is more specific:
- September 18, 2026: The group confirmed that a server it manages had been hit by a ransomware attack.
- October 15, 2026: The group confirmed that data the attacker says it took had been published on an external website.
- October 16 (Japanese, via @Press) and October 19 (English): The second update was published.
Timeline discrepancy. Japan Cyber Watch reports that Eclipse added The Japan Times to its leak site around October 1, 2026, and threatened to publish data unless the company made contact. The same outlet says Eclipse's post gives September 30 as the attack date. The company says it confirmed the attack on September 18. Accounts differ, and the gap has not been explained. Possible reasons include the attacker dating its post to when it took action, or the company dating its detection differently. The company's own date should take precedence. Defenders should still note that the threat actor's timeline and the victim's timeline do not match.
The group says it isolated the affected server immediately. It is now working with several outside specialist firms to compare the published data against its own records, and it continues log monitoring. It is filing preliminary and follow-up reports with Japan's Personal Information Protection Commission (PPC) and the police department with jurisdiction.
Japan Cyber Watch also points out that this incident has nothing to do with the recent Times Car breach. The two companies only share a word in their names.
What Was Taken
According to the company's English and Japanese notices, the published data may include:
- HR-related information for the group, covering 2001 to August 2022
- Business partner information for the same period
No volume has been disclosed. The company has given no record count, number of affected people, or size of the leaked data, and none of the eight sources reviewed for this brief gives a figure. The company says the specific content and scope of the published data are still being identified.
The group stresses several limits on what was exposed:
- The server holds no data from after August 2022.
- The Japan Times Online, subscriber databases and payment systems run on separate infrastructure. In its October 2 notice, as reported by Japan Cyber Watch, the company said no impact had been found on those systems.
HR files spanning two decades are a sensitive category. They may include employee personal details, pay, evaluations and identity documents, although the company has not listed the specific fields. Business partner data can be used for invoice fraud and convincing phishing. The company says it will contact affected partners and individuals one by one as its review continues. It has set up a contact address at News2u Holdings for people it cannot reach directly: [email protected].
Why It Matters
Retired servers still hold live risk. The server had been out of active use for more than four years, yet it still held 21 years of HR and partner records and could still be reached by an attacker. Many organizations leave this kind of legacy file share connected after a migration, and it gives attackers sensitive data with little monitoring around it.
Separate infrastructure limited the damage. Keeping subscriber and payment systems on separate infrastructure appears to have contained the impact. Without that separation, a newspaper's customer database and payment systems could have been exposed as well.
Part of a wave of Japanese breaches. The incident lands during a heavy run of breach disclosures in Japan. A Jiji report carried by The Japan Times on October 17 lists several others:
- Yamato Transport: 5.31 million records
- Nikkei: about 1.83 million records
- The Times Car operator (Park24): about 6.6 million records
- Keio: outside experts suspect the Qilin ransomware group
- Fancl/Attenir: about 830,000 customers
- Japan Post
A news aggregator, the news now, grouped the Japan Times update with this wider trend. JPCERT/CC issued an alert on October 8 about a series of breaches at Japanese organizations. NHK reports, however, that JPCERT/CC said that analysis does not cover ransomware attacks. Nothing in the sources links the Japan Times incident to that campaign.
A new group. Japan Cyber Watch describes Eclipse as a new ransomware group. This attribution comes from a single outlet and has not been confirmed by the victim. If accurate, it would make The Japan Times an early, high-profile victim of an emerging operation.
The Attack Technique
The way in has not been disclosed. Neither company notice explains how the attacker reached the server, which ransomware strain was used, or whether files were encrypted as well as stolen. An October 10 review by Incident Radar collected 30 Japanese organizations whose official notices described how attackers got in. The Japan Times was not among them, which fits with the company not having published a root cause.
Context from the wider Japanese threat picture, which should not be read as attribution for this incident:
- JPCERT/CC (October 15): Its analysis of attacker servers in the recent breach series found:
- AI-assisted scanning for known vulnerabilities
- Reverse engineering of Android APK and Flutter apps (using tools such as Blutter and jadx) to find API endpoints, then testing them for SSRF
- On a separate, unrelated server: evidence of EDR bypass attempts, web shells, and tooling aimed at MySQL, Jenkins and mail gateways
- NHK, summarizing JPCERT/CC: Three main methods were scanning for known software vulnerabilities, abusing protocols that let apps and systems talk to each other (APIs), and exploiting an analytics platform flaw disclosed in August.
- Incident Radar: Recent Japanese ransomware cases traced back to network device and VPN vulnerabilities, such as those at Anabuki Housing Service and the Digital Agency, show perimeter devices are a common entry point.
Unless the group publishes more, the path into a legacy administrative file server should be treated as unknown.
What Organizations Should Do
- Find and retire legacy data stores. Inventory file servers and shares that are no longer in active use. Archive their contents offline, or delete them where no law or contract requires keeping them. JPCERT/CC (via NHK) explicitly recommends deleting personal data that no longer needs to be stored.
- Keep crown-jewel systems separate. Run customer, subscriber and payment systems on separate infrastructure from corporate and administrative networks, as The Japan Times did. Test regularly that the separation holds against lateral movement.
- Patch internet-facing devices and services first. Prioritize VPNs, network devices, BI and analytics tools, and APIs. Japanese incidents in 2026 show attackers moving quickly from public disclosure to exploitation.
- Monitor for bulk data leaving the network. Ransomware crews now steal data before encrypting it. Alert on large outbound transfers from file servers, especially ones that should be dormant.
- Prepare for phishing after a leak. Leaked partner and HR data enables impersonation. Warn staff and partners in advance. The Japan Times has itself warned about emails and calls impersonating the group. Require out-of-band verification for payment or banking changes.
- Watch leak sites and report early. Track ransomware leak sites for your organization's name and your suppliers'. Line up PPC and police reporting procedures ahead of time so notifications can go out within regulatory deadlines.
Sources: Update 2 Report on Unauthorized Access to Group Managed Server and... | The Japan Times Breach: Eclipse Ransomware Gang Claims Attack on Gr... | Japanese Firms Report Unauthorized Server Access and Data Breaches... | 連続不正アクセス事案の攻撃手法に関する調査 - JPCERT/CC Eyes JPCERTコーディネーションセンター公式ブログ | 不正アクセスはどこから入られたのか 公式の発表の文で読む｜インシデントレーダー | Cyberattacks continue to menace Japan as more firms disclose data b... | 【第2報】当社グループ管理サーバーへの不正アクセスおよび情報漏えいの可能性に関するご報告 株式会社ジャパンタイムズ | 3 hacking methods primarily used in Japan data leaks NHK WORLD-JAP...