By Makiko Yamazaki and Benoit Van Overstraeten
TOKYO/PARIS (Reuters) -A Toshiba (OTC:TOSYY) Corp unit said it was hacked by the DarkSide ransomware group, overshadowing an announcement of a strategic review for the Japanese conglomerate under pressure from activist shareholders to seek out suitors.
Toshiba Tec Corp, which makes products such as bar code printers and is valued at $2.3 billion, was hacked by DarkSide - the group widely believed to be behind the recent Colonial Pipeline attack, its French subsidiary said.
It added, however, that only a minimal amount of work data had been lost.
"There are around 30 groups within DarkSide that are attempting to hack companies all the time, and they succeeded this time with Toshiba," said Takashi Yoshikawa, a senior malware analyst at Mitsui Bussan Secure Directions.
Employees accessing company computer systems from home during pandemic lockdowns have made firms more vulnerable to cyber attacks, he added.
Screenshots of DarkSide's post provided by the cybersecurity firm said more than 740 gigabytes of information was compromised and included passports and other personal information.
Reuters could not access DarkSide's public-facing website on Friday. Security researchers said DarkSide's multiple websites had stopped being accessible.
Ransomware attacks have increased in number and amount of demands, with hackers encrypting data and seeking payment in cryptocurrency to unlock it. They increasingly release stolen data as well, or threaten to unless they are paid more.
Ireland's health service said on Friday it had shut down its IT systems after what it described as a "significant" ransomware attack.
Investigators in the U.S's Colonial case say the attack software was distributed by DarkSide, which includes Russian speakers and avoids hacking targets in the former Soviet Union. DarkSide lets "affiliates" hack into targets elsewhere, then handles the ransom negotiation and data release.
STRATEGIC REVIEW
Amid calls from shareholders to explicitly seek offers from potential suitors after dismissing a $20 billion take-private bid from CVC Capital this year, Toshiba said it was setting up a strategic review committee and had appointed UBS as financial adviser.
The review will be conducted by independent directors and is designed to help the board consider a new business plan to be put forward by management by October.
The CVC offer faced strong opposition within the company. Its plan to retain management was perceived by some as aimed at shielding former CEO Nobuaki Kurumatani from activist shareholders.
At a briefing by the company on Friday, 3D Investment Partners and Farallon Capital Management, its No. 2 and No. 3 shareholders respectively, both criticised Toshiba for appearing reluctant to consider offers to go private.
Chief Executive Satoshi Tsunakawa responded that the company has "no reluctance to consider various proposals to increase corporate value, including going private."
Sources have said other private equity investors such as KKR & Co (NYSE:KKR) Inc and Bain Capital are interested in Toshiba.
However, the Asahi newspaper reported on Friday that Bain Capital is not considering buying Toshiba, citing an interview with Yuji Sugimoto, the head of Bain Capital's Japan operations.
Battered by accounting scandals, massive writedowns for its U.S. nuclear business as well as the sale of its chip unit, Toshiba is a shadow of its former self.
But it remains one of Japan's few manufacturers of nuclear power reactors and makes defence equipment, meaning any sale of would require government approval.
Toshiba on Friday forecast a 63% rise in annual operating profit to 170 billion yen ($1.6 billion), rebounding from pandemic-induced pain in the last year and as restructuring measures bear fruit. That follows a 20% slide in profit last year.
Toshiba also nominated four new board members after Kurumatani resigned last month. Kurumatani had been under fire due to allegations that investors were pressured before a shareholder meeting last year to support desired board nominations.
Shareholders in March successfully voted for an independent investigation into those allegations, marking a watershed victory for corporate governance in Japan. The probe is due to conclude before this year's annual general meeting on June 25.
The board nominations announced on Friday included George Olcott, a former UBS banker who is also an independent board member at Japanese beer maker Kirin Holdings.