NDI
Company Details
Linkedin ID:
global-ntt
Website:
Employees number:
58,499
Number of followers:
1,082,339
NAICS:
5415
Industry Type:
Homepage:
global.ntt
IP Addresses:
0
Company ID:
NTT_7944945
Scan Status:
In-progress
NTT DATA, Inc. Company CyberSecurity Posture
global.ntt
NTT DATA, Inc. is a trusted global innovator of business and technology services. We're committed to helping clients innovate, optimize and transform for long-term success. Our R&D investments help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure, and connectivity.
NTT DATA, Inc. A.I CyberSecurity Scoring
NDI Risk Score (AI oriented)Between 800 and 849
NDI
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
NDI Global Score (TPRM)XXXX
NDI
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
NDI Company CyberSecurity News & History
Past Incidents
3
Attack Types
2
NTT Communications Corporation
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: NTT Communications Corporation reported a cybersecurity incident affecting approximately 18,000 corporate customers. Hackers compromised the 'Order Information Distribution System,' resulting in the potential theft of customer names, contact details, and service usage information. Despite the security breach discovery on February 5 and the containment of threats, further investigation revealed an attacker's pivot to another network device on February 15, which was also disconnected. NTT's incident response did not include personalized notifications; instead, a public website announcement was made. The breach did not affect contracts for smartphones and mobile phones provided by NTT Docomo.
NTT Communications
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: NTT Communications, a Japanese telecoms service provider, has experienced a significant data breach with unauthorized access detected on February 5th and again on February 15th. The breach has potentially compromised data related to nearly 18,000 corporate customers' mobile phone contracts, including customer names, contacts, phone numbers, email addresses, and information about service usage. This data leak poses a risk to the confidentiality of customer information and could have severe repercussions for those affected.
NTT Data (via Vectorform subsidiary)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The cybercrime group **Coinbase Cartel** targeted **NTT Data**, a Japanese IT services giant, by exploiting vulnerabilities in its US subsidiary **Vectorform** (acquired in 2022). The attack involved **large-scale data exfiltration** without encryption, leveraging exposed credentials in cloud repositories (e.g., AWS, GitHub) and potential insider assistance. While NTT Data denied a direct breach, Vectorform’s systems were compromised, with sensitive operational, client, or proprietary data stolen. Coinbase Cartel employed a **‘leak-only’ ransomware model**, threatening public disclosure to extort payment while avoiding system disruption. The stolen data—likely including logistics, supply chain, or corporate intelligence—poses **reputational, legal, and financial risks**, particularly given the transportation/logistics sector’s reliance on third-party integrations (TMS, WMS, EDI). The breach underscores vulnerabilities in **vendor access controls, credential hygiene, and segmentation**, with the group staging leaks to pressure negotiations. No encryption occurred, but the **theft of high-value data** exposes NTT Data to regulatory scrutiny, customer distrust, and potential litigation, especially if client or employee records were exposed.
NDI Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for NDI
Incidents vs IT Services and IT Consulting Industry Average (This Year)
No incidents recorded for NTT DATA, Inc. in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for NTT DATA, Inc. in 2025.
Incident Types NDI vs IT Services and IT Consulting Industry Avg (This Year)
No incidents recorded for NTT DATA, Inc. in 2025.
Incident History — NDI (X = Date, Y = Severity)
NDI cyber incidents detection timeline including parent company and subsidiaries
NDI Company Subsidiaries
NTT DATA, Inc. is a trusted global innovator of business and technology services. We're committed to helping clients innovate, optimize and transform for long-term success. Our R&D investments help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure, and connectivity.
Loading...
NDI Similar Companies
Infosys BPM
Infosys BPM Ltd., the business process management subsidiary of Infosys Ltd. (NYSE: INFY), was set up in April 2002. Infosys BPM focuses on integrated end-to-end outsourcing and delivers transformational benefits to its clients through reduced costs, ongoing productivity improvements, and process re
Capgemini
Capgemini is a global business and technology transformation partner, helping organizations to accelerate their dual transition to a digital and sustainable world, while creating tangible impact for enterprises and society. It is a responsible and diverse group of 340,000 team members in more than 5
Luxoft
Luxoft, a DXC Technology Company (NYSE: DXC), is a digital strategy and software engineering firm providing bespoke technology solutions that drive business change for customers the world over. Acquired by U.S. company DXC Technology in 2019, Luxoft is a global operation in 44 cities and 21 countrie
Insight
Insight Enterprises, Inc. is a Fortune 500 solutions integrator helping organizations accelerate their digital journey to modernize their business and maximize the value of technology. Insight’s technical expertise spans cloud and edge-based transformation solutions, with global scale and optimizati
iSoftStone
iSoftStone is a global IT service and consulting company‚ÄØthat creates value and drives success through technology solutions, service excellence, and digital innovation. We specialize in web and application development, software testing and support, data and content management, digital experience,
Accenture in India
Accenture is a global professional services company with leading capabilities in digital, cloud and security. Combining unmatched experience and specialized skills across more than 40 industries, we offer Strategy and Consulting, Interactive, Technology and Operations services — all powered by the w
Hexaware Technologies
At Hexaware, we're not just a global technology and business process services company; we're a community of 31,600+ Hexawarians dedicated to one singular purpose: creating smiles through the power of great people and technology. With a presence in 58 offices across 28 countries, we empower enterpris
GlobalLogic Latinoamérica
GlobalLogic, una empresa del grupo Hitachi, es líder en ingeniería digital en Latinoamérica. Ayudamos a diferentes marcas a diseñar y crear productos, plataformas y experiencias digitales innovadoras para el mundo moderno. Al integrar el diseño de experiencia, la ingeniería compleja y la exper
Bring teams together, reimagine workspaces, engage new audiences, and delight your customers –– all on the Zoom platform you know and love. 💙 Zoomies help people stay connected so they can get more done together. We set out on a mission to make video communications frictionless and secure by buildi
.png)
NDI CyberSecurity News
October 14, 2025 07:00 AM
NTT DATA and Fortanix Announce Global Partnership to Strengthen Security in the AI and Post-Quantum Era
New Cryptography-as-a-Service offering equips enterprises to combat today's cybersecurity threats and prepare for tomorrow's quantum risks.
September 19, 2025 07:00 AM
CyberCX, Westcon, NTT Data recognised among Palo Alto Networks’ top APJ partners
CyberCX, Westcon and NTT Data have been awarded top regional honours at Palo Alto Networks' 2025 Asia Pacific and Japan (APJ) Partner Awards...
September 11, 2025 04:09 AM
BRUSA HyPower boosts cybersecurity and minimizes compliance risks
BRUSA HyPower AG faced growing challenges due to the increasing threat of cyberattacks, which put their assets and compliance at risk.
August 11, 2025 07:00 AM
NTT DATA Launches Global Business Unit for Microsoft Cloud to Accelerate Enterprise Transformation in the AI Era
NTT DATA, a global leader in digital business and technology services, today announced its NTT Data business unit for Microsoft Cloud to...
August 02, 2025 07:00 AM
NTTDATA-CERT Member Presents Arsenal Session at Black Hat USA 2025
NTT DATA, a global leader in digital business and technology services, today announced that three open-source cybersecurity tools created by...
June 18, 2025 09:20 AM
A CISO's guide to mastering AI risk
AI has elevated cybersecurity from a technological risk into a business risk. Its immense potential for innovation and growth is coupled with new and...
June 17, 2025 07:00 AM
NTT DATA Research Reveals C-Suite Misalignment Over GenAI Adoption
NTT DATA, a global leader in digital business and technology services, today launched its new report, “The AI Security Balancing Act: From...
April 30, 2025 03:03 PM
NTT DATA supports Clients operating in different Sectors to address OT Cybersecurity
Companies across diverse market sectors - from Manufacturing to Energy & Utilities, from Chemicals to Infrastructure – are, also due to regulatory pressure,...
April 15, 2025 04:14 AM
NTT DATA provides its UMDR Customers with CyFirma Cyber Threat Intelligence
NTT DATA, a global leader in IT services, has partnered with CyFirma to enhance its Cyber Threat Intelligence (CTI) services.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
NDI CyberSecurity History Information
Official Website of NTT DATA, Inc.
The official website of NTT DATA, Inc. is https://services.global.ntt/.
NTT DATA, Inc.’s AI-Generated Cybersecurity Score
According to Rankiteo, NTT DATA, Inc.’s AI-generated cybersecurity score is 806, reflecting their Good security posture.
How many security badges does NTT DATA, Inc.’ have ?
According to Rankiteo, NTT DATA, Inc. currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does NTT DATA, Inc. have SOC 2 Type 1 certification ?
According to Rankiteo, NTT DATA, Inc. is not certified under SOC 2 Type 1.
Does NTT DATA, Inc. have SOC 2 Type 2 certification ?
According to Rankiteo, NTT DATA, Inc. does not hold a SOC 2 Type 2 certification.
Does NTT DATA, Inc. comply with GDPR ?
According to Rankiteo, NTT DATA, Inc. is not listed as GDPR compliant.
Does NTT DATA, Inc. have PCI DSS certification ?
According to Rankiteo, NTT DATA, Inc. does not currently maintain PCI DSS compliance.
Does NTT DATA, Inc. comply with HIPAA ?
According to Rankiteo, NTT DATA, Inc. is not compliant with HIPAA regulations.
Does NTT DATA, Inc. have ISO 27001 certification ?
According to Rankiteo,NTT DATA, Inc. is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of NTT DATA, Inc.
NTT DATA, Inc. operates primarily in the IT Services and IT Consulting industry.
Number of Employees at NTT DATA, Inc.
NTT DATA, Inc. employs approximately 58,499 people worldwide.
Subsidiaries Owned by NTT DATA, Inc.
NTT DATA, Inc. presently has no subsidiaries across any sectors.
NTT DATA, Inc.’s LinkedIn Followers
NTT DATA, Inc.’s official LinkedIn profile has approximately 1,082,339 followers.
NAICS Classification of NTT DATA, Inc.
NTT DATA, Inc. is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.
NTT DATA, Inc.’s Presence on Crunchbase
No, NTT DATA, Inc. does not have a profile on Crunchbase.
NTT DATA, Inc.’s Presence on LinkedIn
Yes, NTT DATA, Inc. maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/global-ntt.
Cybersecurity Incidents Involving NTT DATA, Inc.
As of November 27, 2025, Rankiteo reports that NTT DATA, Inc. has experienced 3 cybersecurity incidents.
Number of Peer and Competitor Companies
NTT DATA, Inc. has an estimated 36,263 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at NTT DATA, Inc. ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach and Cyber Attack.
How does NTT DATA, Inc. detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with disconnection of compromised devices, and communication strategy with public website announcement, and containment measures with enforce least-privilege access for tms/wms/edi systems, containment measures with disable legacy email protocols (imap/pop3), containment measures with implement phishing-resistant mfa, and remediation measures with deploy data loss prevention (dlp) for microsoft 365/google drive/email, remediation measures with monitor/block mass downloads via service accounts, remediation measures with configure alerts for mailbox forwarding rules and bulk compression, remediation measures with enhance edr coverage for admin/remote hosts, and network segmentation with recommended to limit lateral movement, and enhanced monitoring with behavioral analytics for anomalies, enhanced monitoring with oauth grant monitoring..
Incident Details
Can you provide details on each incident ?
Title: NTT Communications Corporation Data Breach
Description: NTT Communications Corporation reported a cybersecurity incident affecting approximately 18,000 corporate customers. Hackers compromised the 'Order Information Distribution System,' resulting in the potential theft of customer names, contact details, and service usage information. Despite the security breach discovery on February 5 and the containment of threats, further investigation revealed an attacker's pivot to another network device on February 15, which was also disconnected. NTT's incident response did not include personalized notifications; instead, a public website announcement was made. The breach did not affect contracts for smartphones and mobile phones provided by NTT Docomo.
Date Detected: 2023-02-05
Date Resolved: 2023-02-15
Type: Data Breach
Attack Vector: Compromise of Order Information Distribution System
Threat Actor: Unknown Hackers
Motivation: Data Theft
Title: NTT Communications Data Breach
Description: NTT Communications, a Japanese telecoms service provider, has experienced a significant data breach with unauthorized access detected on February 5th and again on February 15th. The breach has potentially compromised data related to nearly 18,000 corporate customers' mobile phone contracts, including customer names, contacts, phone numbers, email addresses, and information about service usage. This data leak poses a risk to the confidentiality of customer information and could have severe repercussions for those affected.
Date Detected: 2023-02-052023-02-15
Type: Data Breach
Title: Coinbase Cartel Data Exfiltration Campaign Targeting Transportation and Logistics Sectors
Description: A new cybercrime group, 'Coinbase Cartel,' has emerged with a focus on data exfiltration (leak-only model) rather than traditional ransomware encryption. The group targets transportation, logistics, and adjacent sectors, exploiting exposed credentials, insider threats, and weak segmentation to steal high-value operational and shipment data. Victims are pressured through staged data leaks and extortion threats, with no disruption to operations, making detection difficult. Confirmed or claimed victims include NTT Data (potentially via subsidiary Vectorform). The group operates with a 'business-like' approach, including partnerships with insiders and staged evidence packages.
Date Detected: 2023-09-15
Date Publicly Disclosed: 2023-09-15
Type: Data Breach
Attack Vector: Exploiting exposed/hard-coded credentials in cloud/source code repositories (AWS, Bitbucket, GitHub)Insider-assisted accessWeak network segmentationThird-party vendor compromises (e.g., TMS, WMS, EDI systems)Staged data leaks for extortion pressure
Vulnerability Exploited: Poor credential hygiene (hard-coded/exposed credentials)Lack of least-privilege access controlsAbsence of phishing-resistant MFAUnmonitored mass data downloads/email exfiltrationLegacy email protocols (IMAP/POP3)Insufficient DLP and behavioral analytics
Threat Actor: Coinbase Cartel
Motivation: Financial Gain (Extortion)Reputational DamageOperational Disruption (via data leaks)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Exposed credentials in cloud repositoriesInsider access (crowdsourced)Third-party vendor compromises (e.g. and Vectorform).
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach NTT1055030725
Data Compromised: Customer names, Contact details, Service usage information
Systems Affected: Order Information Distribution SystemAnother Network Device
Incident : Data Breach NTT030031025
Data Compromised: Customer names, Contacts, Phone numbers, Email addresses, Information about service usage
Incident : Data Breach NTT0902709102325
Data Compromised: Operational data, Shipment data, High-value corporate data (potentially pii)
Systems Affected: Transportation Management Systems (TMS)Warehouse Management Systems (WMS)EDI linksCloud repositories (AWS, Bitbucket, GitHub)Email systems (Microsoft 365, Google Drive)
Downtime: None (no encryption or operational disruption)
Operational Impact: Reputational risk from staged data leaksLegal/regulatory exposurePotential supply chain disruptions if vendor data is compromised
Brand Reputation Impact: High (public extortion threats and staged leaks)Loss of trust in supply chain integrity
Legal Liabilities: Potential GDPR/CCPA violations if PII is exposedContractual breaches with third-party vendors
Identity Theft Risk: Possible (if PII is exfiltrated)
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Names, Contact Details, Service Usage Information, , Customer Names, Contacts, Phone Numbers, Email Addresses, Information About Service Usage, , Operational Data, Shipment Data, Source Code (Potential), Corporate Emails, Potentially Pii and .
Which entities were affected by each incident ?
Incident : Data Breach NTT1055030725
Entity Name: NTT Communications Corporation
Entity Type: Corporation
Industry: Telecommunications
Customers Affected: 18000
Incident : Data Breach NTT030031025
Entity Name: NTT Communications
Entity Type: Telecom Service Provider
Industry: Telecommunications
Location: Japan
Customers Affected: 18,000
Incident : Data Breach NTT0902709102325
Entity Name: NTT Data
Entity Type: IT Services
Industry: Technology
Location: Japan (global operations)
Size: Large enterprise
Incident : Data Breach NTT0902709102325
Entity Name: Vectorform (subsidiary of NTT Data)
Entity Type: IT Services/Software Development
Industry: Technology
Location: United States
Incident : Data Breach NTT0902709102325
Entity Name: Unnamed transportation/logistics companies (multiple continents)
Entity Type: 3PL Providers, Carriers, Brokers, Customs Agents
Industry: Transportation and Logistics
Location: Global
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach NTT1055030725
Containment Measures: Disconnection of Compromised Devices
Communication Strategy: Public Website Announcement
Incident : Data Breach NTT0902709102325
Containment Measures: Enforce least-privilege access for TMS/WMS/EDI systemsDisable legacy email protocols (IMAP/POP3)Implement phishing-resistant MFA
Remediation Measures: Deploy Data Loss Prevention (DLP) for Microsoft 365/Google Drive/emailMonitor/block mass downloads via service accountsConfigure alerts for mailbox forwarding rules and bulk compressionEnhance EDR coverage for admin/remote hosts
Network Segmentation: ['Recommended to limit lateral movement']
Enhanced Monitoring: Behavioral analytics for anomaliesOAuth grant monitoring
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach NTT1055030725
Type of Data Compromised: Customer names, Contact details, Service usage information
Number of Records Exposed: 18000
Personally Identifiable Information: Customer NamesContact Details
Incident : Data Breach NTT030031025
Type of Data Compromised: Customer names, Contacts, Phone numbers, Email addresses, Information about service usage
Number of Records Exposed: 18,000
Incident : Data Breach NTT0902709102325
Type of Data Compromised: Operational data, Shipment data, Source code (potential), Corporate emails, Potentially pii
Sensitivity of Data: High (operational integrity, supply chain data)
Data Exfiltration: Confirmed (staged leaks)Mass downloads via cloud/email
Data Encryption: None (leak-only model)
File Types Exposed: ZIP archives (bulk compression)EmailsDatabase exportsSource code
Personally Identifiable Information: Possible (not confirmed)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Deploy Data Loss Prevention (DLP) for Microsoft 365/Google Drive/email, Monitor/block mass downloads via service accounts, Configure alerts for mailbox forwarding rules and bulk compression, Enhance EDR coverage for admin/remote hosts, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disconnection of compromised devices, , enforce least-privilege access for tms/wms/edi systems, disable legacy email protocols (imap/pop3), implement phishing-resistant mfa and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Data Breach NTT0902709102325
Ransomware Strain: N/A (leak-only, no encryption)
Data Encryption: None
Data Exfiltration: Primary tactic
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach NTT0902709102325
Regulations Violated: Potential GDPR (if EU data exposed), CCPA (if California residents affected), Industry-specific data protection laws,
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach NTT0902709102325
Lessons Learned: Leak-only extortion models bypass traditional ransomware defenses (no encryption = no operational disruption but high reputational risk)., Third-party vendors (e.g., Vectorform) can serve as attack vectors for larger targets (e.g., NTT Data)., Insider threats are actively crowdsourced by groups like Coinbase Cartel., Complex supply chains (transportation/logistics) create expansive attack surfaces.
What recommendations were made to prevent future incidents ?
Incident : Data Breach NTT0902709102325
Recommendations: Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Leak-only extortion models bypass traditional ransomware defenses (no encryption = no operational disruption but high reputational risk).,Third-party vendors (e.g., Vectorform) can serve as attack vectors for larger targets (e.g., NTT Data).,Insider threats are actively crowdsourced by groups like Coinbase Cartel.,Complex supply chains (transportation/logistics) create expansive attack surfaces.
References
Where can I find more information about each incident ?
Incident : Data Breach NTT0902709102325
Source: Media investigation (unnamed)
Incident : Data Breach NTT0902709102325
Source: Coinbase Cartel darknet leak site
Incident : Data Breach NTT0902709102325
Source: NTT Data public statement (denial of confirmed breach)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Media investigation (unnamed), and Source: Coinbase Cartel darknet leak site, and Source: NTT Data public statement (denial of confirmed breach).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach NTT0902709102325
Investigation Status: Ongoing (group active as of latest reports)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Website Announcement.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach NTT0902709102325
Entry Point: Exposed Credentials In Cloud Repositories, Insider Access (Crowdsourced), Third-Party Vendor Compromises (E.G., Vectorform),
High Value Targets: Tms/Wms/Edi Systems, Supply Chain Data, Corporate Emails,
Data Sold on Dark Web: Tms/Wms/Edi Systems, Supply Chain Data, Corporate Emails,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach NTT0902709102325
Root Causes: Poor Credential Management (Hard-Coded/Exposed Credentials In Repositories)., Lack Of Segmentation Between Subsidiaries (E.G., Vectorform → Ntt Data)., Insufficient Monitoring For Data Exfiltration (No Dlp/Behavioral Alerts)., Over-Reliance On Third-Party Vendors With Weak Security Postures.,
Corrective Actions: Mandate Mfa And Least-Privilege Access For All Systems., Isolate High-Value Systems (Tms/Wms) From Third-Party Networks., Deploy Dlp And Edr With Behavioral Analytics For Exfiltration Detection., Audit Cloud Repositories For Exposed Credentials.,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Behavioral Analytics For Anomalies, Oauth Grant Monitoring, .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Mandate Mfa And Least-Privilege Access For All Systems., Isolate High-Value Systems (Tms/Wms) From Third-Party Networks., Deploy Dlp And Edr With Behavioral Analytics For Exfiltration Detection., Audit Cloud Repositories For Exposed Credentials., .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Unknown Hackers and Coinbase Cartel.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2023-02-05.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-09-15.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2023-02-15.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Customer Names, Contact Details, Service Usage Information, , customer names, contacts, phone numbers, email addresses, information about service usage, , Operational data, Shipment data, High-value corporate data (potentially PII) and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Order Information Distribution SystemAnother Network Device and Transportation Management Systems (TMS)Warehouse Management Systems (WMS)EDI linksCloud repositories (AWS, Bitbucket, GitHub)Email systems (Microsoft 365, Google Drive).
Response to the Incidents
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Disconnection of Compromised Devices and Enforce least-privilege access for TMS/WMS/EDI systemsDisable legacy email protocols (IMAP/POP3)Implement phishing-resistant MFA.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were information about service usage, Service Usage Information, High-value corporate data (potentially PII), Contact Details, Operational data, Shipment data, email addresses, contacts, phone numbers, Customer Names and customer names.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 18.2K.
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Complex supply chains (transportation/logistics) create expansive attack surfaces.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements). and Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are NTT Data public statement (denial of confirmed breach), Media investigation (unnamed) and Coinbase Cartel darknet leak site.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (group active as of latest reports).
Initial Access Broker
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=global-ntt' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
