Japanese media giant investigating another reported data leak by BlackSuit hackers

A major Japanese media company known for producing manga, anime and video games is still investigating a cyberattack on its systems following reports that a ransomware group leaked a new batch of its information on the dark web.

Kadokawa was hit by a ransomware attack in June, and in a statement on Tuesday, the company said it is “continuing to work diligently toward the complete restoration of its operations.”

Several researchers observed that the ransomware gang BlackSuit, which claimed responsibility for the attack, uploaded new data allegedly stolen from Kadokawa to its darknet site earlier this week.

🚨Cyberattack Alert Update ‼️

🇯🇵Japan - KADOKAWA

Black Suit ransomware group leaks the exfiltrated files from KADOKAWA once again, this time with additional data, as indicated by the upload date of September 10th.

Last August, the cybercriminal group warned the company that… https://t.co/36p93C5DKS pic.twitter.com/pWi03OBjoR

— HackManac (@H4ckManac) September 10, 2024

“We have confirmed that the organization claiming responsibility for the attack has made additional claims of releasing some of our group’s information,” Kadokawa said. “We are addressing this matter with the assistance of law enforcement and external security experts.”

At present, no evidence of new cyberattacks on the company’s systems has been detected, according to the statement. Kadokawa hasn’t confirmed if BlackSuit was indeed behind the attack and has not replied to requests for comment.

BlackSuit began publishing small samples of the data allegedly stolen from Kadokawa in late June. The hackers threatened to publish a remaining 1.5 terabytes of company files if it did not pay a ransom.

BlackSuit is a rebrand of the Royal ransomware group, whose operators are believed to be from the now-defunct Conti cybercrime gang.

Kadokawa previously stated the leaked data included business partner information, such as contracts and other documents, as well as internal company data including personal information on all employees of its subsidiary Dwango, which runs the popular Japanese video-sharing site Niconico.

In a new statement, Kadokawa claimed that the most recently published information is likely “not new,” but added that it will continue to examine it with help from “external experts.”

“We deeply apologize for the significant concern and inconvenience the attack has caused,” the company added.

Kadokawa operates various businesses in the film, publishing, and gaming industries. It runs a Japanese e-book store called BookWalker, which sells manga, novels, and magazines from various publishers, and it also holds a majority stake in FromSoftware, the developer of the popular video game Elden Ring.

The cyberattack in June impacted most of Kadokawa’s and its subsidiary’s operations, as they were hosted in the same data center.