Incident : Data Breach

NTT1055030725

Exposure Impact

Title: NTT Communications Corporation Data Breach

Description: NTT Communications Corporation reported a cybersecurity incident affecting approximately 18,000 corporate customers. Hackers compromised the 'Order Information Distribution System,' resulting in the potential theft of customer names, contact details, and service usage information. Despite the security breach discovery on February 5 and the containment of threats, further investigation revealed an attacker's pivot to another network device on February 15, which was also disconnected. NTT's incident response did not include personalized notifications; instead, a public website announcement was made. The breach did not affect contracts for smartphones and mobile phones provided by NTT Docomo.

Date Detected: 2023-02-05

Date Resolved: 2023-02-15

Type: Data Breach

Attack Vector: Compromise of Order Information Distribution System

Threat Actor: Unknown Hackers

Motivation: Data Theft

Incident : Data Breach

NTT030031025

Exposure Impact

Title: NTT Communications Data Breach

Description: NTT Communications, a Japanese telecoms service provider, has experienced a significant data breach with unauthorized access detected on February 5th and again on February 15th. The breach has potentially compromised data related to nearly 18,000 corporate customers' mobile phone contracts, including customer names, contacts, phone numbers, email addresses, and information about service usage. This data leak poses a risk to the confidentiality of customer information and could have severe repercussions for those affected.

Date Detected: 2023-02-052023-02-15

Type: Data Breach

Incident : Data Breach

NTT0902709102325

Exposure Impact

Title: Coinbase Cartel Data Exfiltration Campaign Targeting Transportation and Logistics Sectors

Description: A new cybercrime group, 'Coinbase Cartel,' has emerged with a focus on data exfiltration (leak-only model) rather than traditional ransomware encryption. The group targets transportation, logistics, and adjacent sectors, exploiting exposed credentials, insider threats, and weak segmentation to steal high-value operational and shipment data. Victims are pressured through staged data leaks and extortion threats, with no disruption to operations, making detection difficult. Confirmed or claimed victims include NTT Data (potentially via subsidiary Vectorform). The group operates with a 'business-like' approach, including partnerships with insiders and staged evidence packages.

Date Detected: 2023-09-15

Date Publicly Disclosed: 2023-09-15

Type: Data Breach

Attack Vector: Exploiting exposed/hard-coded credentials in cloud/source code repositories (AWS, Bitbucket, GitHub)Insider-assisted accessWeak network segmentationThird-party vendor compromises (e.g., TMS, WMS, EDI systems)Staged data leaks for extortion pressure

Vulnerability Exploited: Poor credential hygiene (hard-coded/exposed credentials)Lack of least-privilege access controlsAbsence of phishing-resistant MFAUnmonitored mass data downloads/email exfiltrationLegacy email protocols (IMAP/POP3)Insufficient DLP and behavioral analytics

Threat Actor: Coinbase Cartel

Motivation: Financial Gain (Extortion)Reputational DamageOperational Disruption (via data leaks)

Incident : Data Breach NTT1055030725

Entity Name: NTT Communications Corporation

Entity Type: Corporation

Industry: Telecommunications

Customers Affected: 18000

Incident : Data Breach NTT030031025

Entity Name: NTT Communications

Entity Type: Telecom Service Provider

Industry: Telecommunications

Location: Japan

Customers Affected: 18,000

Incident : Data Breach NTT0902709102325

Entity Name: NTT Data

Entity Type: IT Services

Industry: Technology

Location: Japan (global operations)

Size: Large enterprise

Incident : Data Breach NTT0902709102325

Entity Name: Vectorform (subsidiary of NTT Data)

Entity Type: IT Services/Software Development

Industry: Technology

Location: United States

Incident : Data Breach NTT0902709102325

Entity Name: Unnamed transportation/logistics companies (multiple continents)

Entity Type: 3PL Providers, Carriers, Brokers, Customs Agents

Industry: Transportation and Logistics

Location: Global

Incident : Data Breach NTT1055030725

Containment Measures: Disconnection of Compromised Devices

Communication Strategy: Public Website Announcement

Incident : Data Breach NTT0902709102325

Containment Measures: Enforce least-privilege access for TMS/WMS/EDI systemsDisable legacy email protocols (IMAP/POP3)Implement phishing-resistant MFA

Remediation Measures: Deploy Data Loss Prevention (DLP) for Microsoft 365/Google Drive/emailMonitor/block mass downloads via service accountsConfigure alerts for mailbox forwarding rules and bulk compressionEnhance EDR coverage for admin/remote hosts

Network Segmentation: ['Recommended to limit lateral movement']

Enhanced Monitoring: Behavioral analytics for anomaliesOAuth grant monitoring

Incident : Data Breach NTT1055030725

Type of Data Compromised: Customer names, Contact details, Service usage information

Number of Records Exposed: 18000

Personally Identifiable Information: Customer NamesContact Details

Incident : Data Breach NTT030031025

Type of Data Compromised: Customer names, Contacts, Phone numbers, Email addresses, Information about service usage

Number of Records Exposed: 18,000

Incident : Data Breach NTT0902709102325

Type of Data Compromised: Operational data, Shipment data, Source code (potential), Corporate emails, Potentially pii

Sensitivity of Data: High (operational integrity, supply chain data)

Data Exfiltration: Confirmed (staged leaks)Mass downloads via cloud/email

Data Encryption: None (leak-only model)

File Types Exposed: ZIP archives (bulk compression)EmailsDatabase exportsSource code

Personally Identifiable Information: Possible (not confirmed)

Incident : Data Breach NTT0902709102325

Ransomware Strain: N/A (leak-only, no encryption)

Data Encryption: None

Data Exfiltration: Primary tactic

Incident : Data Breach NTT0902709102325

Regulations Violated: Potential GDPR (if EU data exposed), CCPA (if California residents affected), Industry-specific data protection laws,

Incident : Data Breach NTT0902709102325

Lessons Learned: Leak-only extortion models bypass traditional ransomware defenses (no encryption = no operational disruption but high reputational risk)., Third-party vendors (e.g., Vectorform) can serve as attack vectors for larger targets (e.g., NTT Data)., Insider threats are actively crowdsourced by groups like Coinbase Cartel., Complex supply chains (transportation/logistics) create expansive attack surfaces.

Incident : Data Breach NTT0902709102325

Recommendations: Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.

Incident : Data Breach NTT0902709102325

Source: Media investigation (unnamed)

Incident : Data Breach NTT0902709102325

Source: Coinbase Cartel darknet leak site

Incident : Data Breach NTT0902709102325

Source: NTT Data public statement (denial of confirmed breach)

Incident : Data Breach NTT0902709102325

Investigation Status: Ongoing (group active as of latest reports)

Incident : Data Breach NTT0902709102325

Entry Point: Exposed Credentials In Cloud Repositories, Insider Access (Crowdsourced), Third-Party Vendor Compromises (E.G., Vectorform),

High Value Targets: Tms/Wms/Edi Systems, Supply Chain Data, Corporate Emails,

Data Sold on Dark Web: Tms/Wms/Edi Systems, Supply Chain Data, Corporate Emails,

Incident : Data Breach NTT0902709102325

Root Causes: Poor Credential Management (Hard-Coded/Exposed Credentials In Repositories)., Lack Of Segmentation Between Subsidiaries (E.G., Vectorform → Ntt Data)., Insufficient Monitoring For Data Exfiltration (No Dlp/Behavioral Alerts)., Over-Reliance On Third-Party Vendors With Weak Security Postures.,

Corrective Actions: Mandate Mfa And Least-Privilege Access For All Systems., Isolate High-Value Systems (Tms/Wms) From Third-Party Networks., Deploy Dlp And Edr With Behavioral Analytics For Exfiltration Detection., Audit Cloud Repositories For Exposed Credentials.,