Toshiba subsidiary confirms ransomware attack, as reports suggest possible DarkSide involvement

A cyberattack from a criminal gang had prompted the company to disconnect network connections..
(Photo by Kazuhiro NOGI / AFP) (Photo by KAZUHIRO NOGI/AFP via Getty Images)

European units of Japanese tech giant Toshiba are investigating a security incident in which scammers may have used a similar hacking tool to the malware used against IT systems at Colonial Pipeline.

The European subsidiaries of Toshiba Tec Group said Friday that a cyberattack from a criminal gang had prompted the company to disconnect network connections between Japan and Europe to stop the spread of the malware. In a statement, Toshiba Tec Group, a unit of the multinational conglomerate which makes printers and other technologies, said the firm had “not yet confirmed a fact that customer related information was leaked externally,” though it suggested a criminal gang is responsible.

Toshiba Tec Group did not name DarkSide, which is both a type of ransomware and an Eastern European criminal syndicate that develops and sells access to the code to other criminals. An unnamed company Toshiba Tec spokesperson told CNBC that DarkSide criminal group appeared to be responsible for the incident. The spokesperson said the company had not paid a ransom.

The French subsidiary of Toshiba Tec said in a tweet Friday that it was the target of a ransomware attack on May 4.


“With backups in place and prompt countermeasures, encrypted data was recovered and connections restored,” the French Toshiba Tec unit said.

Toshiba Tec did not immediately respond to a request for comment from CyberScoop.

“[T]he extent of impact has been limited to some regions in Europe and we have not yet confirmed a fact that customer related information was leaked externally,” Toshiba Tec Group’s statement continued. The company also acknowledged the possibility “that some information and data may have been leaked by the criminal gang.”

Toshiba Tec would be only the latest victim of the DarkSide criminal syndicate. Since emerging in last August, the malicious code has reportedly been used to steal millions of dollars in intrusion of companies in various sectors.

The FBI has blamed the DarkSide ransomware for the temporary shutdown of Colonial Pipeline, which says it provides some 45% of fuel to the East Coast, and President Joe Biden has vowed to retaliate against the criminals.

Sean Lyngaas

Written by Sean Lyngaas

Sean Lyngaas is CyberScoop’s Senior Reporter covering the Department of Homeland Security and Congress. He was previously a freelance journalist in West Africa, where he covered everything from a presidential election in Ghana to military mutinies in Ivory Coast for The New York Times. Lyngaas’ reporting also has appeared in The Washington Post, The Economist and the BBC, among other outlets. His investigation of cybersecurity issues in the nuclear sector, backed by a grant from the Pulitzer Center on Crisis Reporting, won plaudits from industrial security experts. He was previously a reporter with Federal Computer Week and, before that, with Smart Grid Today. Sean earned a B.A. in public policy from Duke University and an M.A. in International Relations from The Fletcher School of Law and Diplomacy at Tufts University.

Latest Podcasts