Skip to content
CBCyber Breaches
Search
RansomwareRansom paid

KADOKAWA / Niconico BlackSuit ransomware (2024)

Phishing access let BlackSuit (Russian-linked) encrypt KADOKAWA's infrastructure and the Niconico video-sharing platform, taking services offline for two months. KADOKAWA paid ~$2.9M in cryptocurrency — and BlackSuit leaked the stolen 1.5 TB anyway.

Victim
KADOKAWA Corporation
Loss
$2.9M
records
254.2K
users
254.2K
SectorMediaEducationTechnology
CountryJapan
Threat actorBlackSuit

On the morning of 8 June 2024, the Japanese media and publishing giant KADOKAWA — owner of the Niconico video platform, dozens of anime and game studios, and the Kadokawa Dwango Educational Institute — suffered a ransomware attack by the Russian-linked BlackSuit group. Niconico went dark, KADOKAWA's corporate infrastructure was paralysed, and the outage stretched for two months.

What happened

The intrusion was traced back to a phishing attack. Once inside, BlackSuit operators encrypted both KADOKAWA's corporate IT and the infrastructure supporting Niconico's video platform. When KADOKAWA tried to shut down compromised servers remotely, the attackers — still active in the network — restarted them. KADOKAWA's incident-response team resorted to physically disconnecting power and network cables in the data centre.

BlackSuit demanded a ransom and threatened to leak 1.5 TB of stolen data if not paid by 1 July 2024. KADOKAWA negotiated, and in December the company paid approximately $2.9 million in cryptocurrency. BlackSuit leaked the data anyway — a public reminder that paying ransomware groups buys neither silence nor honour.

KADOKAWA's stock dropped over 20% by early July 2024. Niconico did not fully come back online until 5 August 2024, nearly two months after the attack.

Impact

  • Niconico and KADOKAWA group services offline for nearly 2 months.
  • KADOKAWA stock down >20% in the weeks after disclosure.
  • 254,241 individuals had personal data leaked, including 186,269 Kadokawa Dwango Educational Institute students.
  • ~$2.9 million ransom paid; data leaked anyway.
  • Triggered widespread reviews of phishing-resilience and BCP for Japanese media infrastructure.

Why it matters

KADOKAWA's experience is one of the cleanest case studies of why paying a ransomware group does not buy data confidentiality. The crew took the payment and dumped the data. The lesson — operationally, legally, and in public communications — has shaped how Japanese boards now approach ransomware decisions.

Financial impact

Reported costs in USD

Total reported loss
2.9M
USD · $2,900,000
Ransom demanded
$2.9M
Ransom paid
$2.9M
  • Ransom paid$2.9M

Timeline

  1. Around 03:30 JST, Niconico and KADOKAWA Group services suffer a connectivity failure. The cause is a BlackSuit ransomware attack.

  2. KADOKAWA publicly confirms a ransomware attack; attackers are observed restarting servers remotely so KADOKAWA physically disconnects power and network cables.

  3. BlackSuit's threatened deadline to leak 1.5 TB of stolen data passes.

  4. Full services restored after roughly two months of downtime.

  5. Internal investigation identifies a phishing attack as the probable initial-access vector.

  6. BlackSuit emails KADOKAWA executives confirming receipt of approximately $2.9M in cryptocurrency — and proceeds to leak the 1.5 TB of stolen data anyway.

  7. Confirmed personal data leak affects 254,241 individuals, including 186,269 students of the Kadokawa Dwango Educational Institute.

Sources

  1. en.wikipedia.orghttps://en.wikipedia.org/wiki/2024_cyberattack_on_Kadokawa_and_Niconico
  2. therecord.mediahttps://therecord.media/kadokawa-japan-reported-ransomware-payment
  3. therecord.mediahttps://therecord.media/japan-anime-giant-data-leak-ransomware
  4. cyberinsider.comhttps://cyberinsider.com/kadokawa-paid-3-million-ransom-blacksuit-ransomware-still-leaked-stolen-data/
  5. group.kadokawa.co.jphttps://group.kadokawa.co.jp/global/information/media-download/1345/840603bf0659e8ce/

Related incidents