Kadokawa and Niconico Ransomware Attack: Timeline and Impact
In June 2024, the Kadokawa Group, a major Japanese media conglomerate, faced a severe cybersecurity crisis that crippled its digital infrastructure and affected millions of users. The incident primarily impacted Niconico, a popular video-sharing service, leading to a prolonged outage and a significant data breach.
The Initial Outage and Response
The crisis began around 3:30 JST on June 8, 2024, when connection problems were first reported across various Kadokawa Group services. By 6:00 JST that same day, Dwango—the operator of Niconico—suspended all problematic services to initiate emergency maintenance.
By June 9, the scale of the incident prompted Kadokawa to report the matter to the police, cybersecurity specialists, and the Kanto Local Finance Bureau to coordinate a formal response.
Technical Details of the Cyberattack
On June 14, Kadokawa confirmed that the service disruptions were the result of a ransomware attack—a type of malware that encrypts data and demands payment for its release. The investigation revealed a persistent effort by the attackers to maintain control over the network.
Despite Kadokawa's attempts to remotely shut down website services, the attackers were observed restarting the servers to continue spreading the malware. To stop the infection, Kadokawa was forced to take the drastic step of physically disconnecting the servers' power and communication cables. On the same day, Niconico launched a temporary website to keep the public informed.
The BlackSuit Ransom Demand
The situation escalated on June 27 when a Russian-linked hacker group known as BlackSuit claimed responsibility for the breach. In a statement published on the dark web—a part of the internet that requires specific software to access and is often used for illegal activities—the group threatened to leak 1.5 terabytes of stolen data. This data included sensitive information belonging to business partners and users.
BlackSuit demanded a ransom payment by July 1 to prevent the public release of the stolen files.
Legal Warnings and Service Restoration
In response to the threat of a data leak, Kadokawa issued a public warning on July 10. The company stated that any individual or entity disseminating leaked information from the breach would face legal action.
After nearly two months of downtime and remediation efforts, Niconico and Kadokawa's official website services finally returned online on August 5, 2024.
Key Facts
- Attack Date: Started June 8, 2024.
- Perpetrator: BlackSuit (Russian-linked hacker group).
- Data Stolen: 1.5 terabytes of user and business partner information.
- Critical Action: Servers had to be physically unplugged to stop malware spread.
- Recovery Date: Services restored on August 5, 2024.
| Date (2024) | Event | Action/Outcome |
|---|---|---|
| June 8 | Initial Outage | Niconico services suspended for maintenance. |
| June 14 | Attack Confirmation | Ransomware confirmed; servers physically disconnected. |
| June 27 | Extortion Claim | BlackSuit claims responsibility; 1.5TB of data stolen. |
| July 10 | Legal Warning | Kadokawa warns against sharing leaked data. |
| August 5 | Restoration | Official websites and Niconico go back online. |
Frequently Asked Questions
What caused the Niconico service outage?
The outage was caused by a ransomware cyberattack that targeted Kadokawa Group services, leading to server instability and the need for emergency shutdowns.
Who was responsible for the attack?
A Russian-linked hacker group called BlackSuit claimed responsibility for the attack via a statement on the dark web.
How much data was stolen during the breach?
The attackers claimed to have stolen 1.5 terabytes of data, which included information from users and business partners.
Why did Kadokawa have to physically disconnect the servers?
Kadokawa discovered that the attackers were remotely restarting servers to continue spreading malware even after the services had been shut down digitally.
When did the services finally return to normal?
Niconico and Kadokawa's official website services were restored and went back online on August 5, 2024.