Ransomware hit Kurita Water Industries' US arm, exposing customer and staff data

Kurita Water Industries, a Tokyo-listed maker of chemicals and equipment for water and wastewater treatment founded in 1949, disclosed on December 7, 2024 that its North American subsidiary had been hit by ransomware.

The company said an alert fired on the security monitoring system of Kurita America Inc., which is headquartered in Minnesota, at around 3pm on Friday November 29, 2024. An investigation carried out with external experts confirmed that multiple servers had been encrypted. The affected servers were disconnected from the network to prevent the damage from spreading further.

Kurita said data stored on the subsidiary's servers belonging to customers, business partners and employees may have been leaked to third parties. The information described in its notice covered accounting and personnel records along with roughly ten years of customer water quality testing data. Kurita America subsequently warned customers to watch for fraudulent payment emails and to verify any payment request using a known telephone number.

The company said its main servers had been restored, that business operations were not disrupted, and that the investigation was continuing. Kurita did not name a threat group in its statements. Kaspersky's ICS CERT later attributed the incident to the 3AM ransomware operation in its review of fourth-quarter 2024 industrial cybersecurity incidents.