Fujifilm refuses to pay ransomware demand, restores network from backups

Japanese multinational conglomerate Fujifilm said it has refused to pay a ransom demand to the cyber gang that attacked its network in Japan and is instead relying on its own backups to restore operations.

The company’s computer systems in the US, Europe, the Middle East and Africa are “fully operational and back to business as usual”, a Fujifilm spokesperson told Verdict.

Fujifilm – a company once known for selling photographic film but which now produces biotechnology, chemical and other digital imaging products – detected unauthorised access to its servers on 1 June.

On 4 June it confirmed a ransomware attack was affecting a “specific network” in Japan and that it shut down “all networks and server systems” while it investigated the “extent and scale” of the attack.

Fujifilm said it would not comment on the amount demanded by the ransomware gang.

“Fujifilm Corporation in Tokyo does not comment on the demand but I can confirm we have not paid any ransom,” the Fujifilm spokesperson said.

When asked if the company has sufficient backups in place to restore from, the spokesperson said: “Fujifilm does have backups in place as a part of its normal operation procedure aligned with its policy.”

Jake Moore, cybersecurity specialist at internet security firm ESET, said refusing to pay a ransom is “not a decision to be taken lightly.”

Ransomware gangs often threaten to leak or sell sensitive data if payment is not made.

However, Fujifilm Europe said it is “highly confident that no loss, destruction, alteration, unauthorised use or disclosure of our data, or our customers’ data, on Fujifilm Europe’s systems has been detected.”

It is not clear if the ransomware gang stole Fujifilm data from the affected network in Japan. Fujifilm declined to comment when asked if those responsible had threatened to publish data if the ransom is not paid.