Four Japanese Firms Face Parallel Intrusions Exposing 4.38 Million Aflac Records and Ransomware Claims

The incidents unfolded over two weeks with Aflac suspending systems after detecting unauthorized access limited to Japanese operations. Nidec confirmed BlackField ransomware on its independent Taiwanese subsidiary network, where the group claimed exfiltration of over 2TB including manufacturing and financial records. KDDI traced entry to a third-party software vulnerability in its ISP email platform and blocked further activity. Sapporo reported suspicious activity only at Pokka and Sleeman without confirmed data loss. Procurement patterns and prior incidents reveal repeated targeting: Nidec faced 8Base and Everest claims in Vietnam in 2024, while Asahi suffered ransomware production halts exposing 1.5 million records last year. No shared infrastructure or identical TTPs link the four cases technically, yet the timing across finance, manufacturing, telecom and beverages aligns with observed supply-chain probing in Japanese critical sectors. Official statements emphasize isolation and swift containment with notifications to police and authorities. Independent verification remains absent for attribution or full data publication, creating gaps between corporate disclosures and ransomware group claims. The pattern suggests reconnaissance of segmented networks rather than opportunistic crime. Next steps include forensic handoffs to Japanese cybersecurity agencies and potential publication of Nidec data if ransom demands go unmet. Expanded monitoring of third-party vendor access across Japanese conglomerates is likely.