Cyberattack on Toyota’s supply chain shuts its 14 factories in Japan for 24 hours

Toyota Motor will restart domestic production from Wednesday after a cyberattack on a supplier ground the automaking giant’s factories to a one-day halt, sparking concerns about vulnerability in Japan Inc’s supply chain.

No information was available about who was behind the attack, nor the motive. It came just after Japan joined Western allies in clamping down on Russia in response to the invasion of Ukraine, although it was unclear whether the attack was related.

Cybersecurity has emerged as a key area of concern in Japan, where government critics say responses to hacking threats have been hampered by a fractured approach: an attack on a hitherto obscure supplier was enough to bring one of the world’s mightiest manufacturers to a domestic standstill.

Toyota’s (TM) production lines will be switched back on at its 14 factories across the country on Wednesday, it said in a statement. Tuesday’s suspension hit output of around 13,000 vehicles.

Kojima Industries, which provides plastic parts and electronic components to the automaker, said it had discovered an error at one of its file servers on Saturday night. After rebooting the server, it confirmed it had been infected with a virus, and found a threatening message, it said in a separate statement.

The message was written in English, a Kojima spokesperson told Reuters, but declined to give further details.

The system failure at Kojima meant the supplier was unable to ship parts, forcing Toyota (TM), which does not stockpile components at its plants, to pause production, a Toyota (TM) spokesperson said.

Top tier

Government ministers said they were following the incident closely. While big companies have cybersecurity measures in place, the government is worried about small or mid-level subcontractors, the industry minister, Koichi Hagiuda, told reporters on Tuesday.

Reports of the powerful malware Emotet being used have increased since the first week of February, according to the Japan Computer Emergency Response Team/Coordination Center, which provides information on cybersecurity.

Emotet is used to gain access to a victim’s computer before then downloading additional malicious software, such as those designed to steal banking passwords, or ransomware which can lock a computer until an extortion fee is paid.

It was not clear whether Emotet was used on the Toyota supplier. Toyota declined to comment on whether it had detected early signs of a potential cyberattack or whether Emotet was responsible for paralysing its operation.

Kojima only supplies to Toyota and is a top-tier supplier of some parts, and a second-tier supplier of others, the Kojima spokesperson said. Toyota’s operations in Japan encompass a supply chain of 60,000 companies across four tiers.

Toyota said it would be able to resume operation by tapping into a backup network between it and the supplier. It would take a week or two to fully restore the system, it said.

In November 2020, Japanese videogame maker Capcom, which makes games including Resident Evil, said a ransomware attack had likely compromised personal information of up to 350,000 gamers, and some of its own financial data had been stolen.

Honda Motor (HMC) suspended some of its auto and motorcycle production globally in June 2020 after a suspected cyberattack.

Toyota shares finished flat on Tuesday, underperforming a 1.2% gain in the broader market.