Corporate Japan has spent the summer absorbing hits. Over a matter of weeks, a manufacturing giant, a brewer, a major telecom, and an insurer have all disclosed cyber incidents — a cluster that, taken together, exposes a recurring blind spot: the risk that lives in subsidiaries, overseas units, and third-party software, far from headquarters’ direct line of sight.

The through-line is not a single actor but a single lesson. Whether the entry point was a ransomware crew called BlackField or an unpatched vulnerability in vendor software, the attackers went in through the edges of these sprawling conglomerates — and the edges held far less well than the core.

Nidec: $2 Million, 2 Terabytes, One “Independent” Subsidiary

Nidec Corporation, the global electric-motor and industrial-components manufacturer, disclosed a ransomware attack against its Taiwanese subsidiary, Nidec Chaun Choung Technology, with damage confirmed on June 22, 2026. The BlackField ransomware group claimed responsibility, demanded $2 million, and said it had stolen more than two terabytes of data — spanning employee, financial, procurement, manufacturing, legal, and IT records.

BlackField ran the standard extortion playbook with unusual precision: it gave Nidec more than 15 days to respond, offered to extend the deadline for $5,000 per day, and dangled immediate data download to any buyer for $400,000. Nidec, for its part, emphasized that the compromised subsidiary “operates on an independent network,” limiting the incident’s blast radius across the wider corporation.

That containment claim is the most instructive detail in the whole cluster. Network segmentation genuinely helped Nidec here — the parent company was insulated. But “independent network” also means the subsidiary was carrying its own security posture, and it lost two terabytes. Segmentation limits how far an attacker spreads; it does nothing to stop the initial theft at the point of entry.

Sapporo: The Same Gang, the Same Demand

Days later, brewer Sapporo Holdings disclosed suspected unauthorized access involving two overseas subsidiaries — Singapore-based beverage maker Pokka and Canadian brewer Sleeman. Sapporo detected suspicious activity, shut down affected systems, and opened an investigation. BlackField again claimed responsibility and again demanded $2 million.

Two conglomerates, two overseas subsidiaries, one ransomware brand, and an identical price tag inside the same window. That is not coincidence — it reads as a threat actor running a repeatable model against Japanese multinationals, hunting specifically for the foreign business units where central security governance is weakest. It is the same structural weakness that put Aflac’s Japan subsidiary in the headlines this month: the further an asset sits from headquarters, the thinner the oversight.

KDDI: 12 Million Emails Through a Third-Party Door

The largest raw exposure came from telecom heavyweight KDDI Corporation, which said attackers gained unauthorized access to an email system it operates for five Japanese internet service providers — STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE — by exploiting a vulnerability in third-party software.

KDDI confirmed that roughly 12.2 million email addresses and 7.6 million passwords were accessed without authorization. That is a credential trove of national scale, and its origin — a flaw in someone else’s software running inside KDDI’s stack — makes it the purest supply-chain lesson of the group. KDDI did not need to be individually targeted or socially engineered; it simply ran vulnerable vendor code, and 12 million records walked out the door.

The Pattern That Ties It Together

Read as a set, the summer’s Japanese incidents map cleanly onto the two dominant failure modes of modern enterprise security:

  1. Ransomware through the subsidiary edge. BlackField’s twin hits on Nidec and Sapporo show a crew deliberately targeting overseas and subsidiary units, where a conglomerate’s security maturity is least consistent. This is the same subsidiary-risk dynamic surfacing across the broader ransomware-as-a-service ecosystem.
  2. Mass data loss through third-party software. KDDI’s breach — like the Oracle-driven wave of PeopleSoft and portal compromises earlier this month — required only an unpatched dependency to expose millions.

For any multinational, the takeaway is uncomfortable but concrete: your security is only as strong as the least-governed unit flying your logo, and only as current as the least-patched piece of vendor code in your environment. BlackField found the first gap. A software vulnerability found the second. Both are still open at thousands of companies that assume “independent network” and “third-party software” are someone else’s problem.

Sources