Kadokawa confirmed a ransomware attack on its data centre and Niconico

Kadokawa Corporation, the Japanese publishing and entertainment group whose holdings include the video sharing platform Niconico and the game studio FromSoftware, said servers in its data centre were hit by a significant cyberattack involving ransomware early on June 8, 2024. Niconico and related services went offline, and the company suspended live streaming and user channels to limit the impact.

In a statement published on June 27, 2024, Kadokawa said it was considering solutions and workarounds across the company in order to normalise its systems and business activities, and that it would publish a further update in July. It said it did not store credit card information on the affected systems, and that it was still investigating whether any information had leaked.

Kadokawa acknowledged on June 29, 2024 that data had in fact been taken. It said the leaked material included business partner information such as contracts and other documents, along with internal company data, and personal data belonging to employees of its subsidiary Dwango, which operates Niconico. The company apologised.

The BlackSuit ransomware group, a successor to Royal and previously linked to the Conti operation, claimed responsibility, said it had taken about 1.5 terabytes of data, published samples and threatened to release the remainder. Kadokawa did not say at the time whether it would pay.