NDI
Company Details
Linkedin ID:
global-ntt
Website:
Employees number:
58,499
Number of followers:
1,082,339
NAICS:
5415
Industry Type:
Homepage:
global.ntt
IP Addresses:
0
Company ID:
NTT_7944945
Scan Status:
In-progress
NTT DATA, Inc. Company CyberSecurity Posture
global.ntt
NTT DATA, Inc. is a trusted global innovator of business and technology services. We're committed to helping clients innovate, optimize and transform for long-term success. Our R&D investments help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure, and connectivity.
NTT DATA, Inc. A.I CyberSecurity Scoring
NDI Risk Score (AI oriented)Between 800 and 849
NDI
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
NDI Global Score (TPRM)XXXX
NDI
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
NDI Company CyberSecurity News & History
Past Incidents
3
Attack Types
2
NTT Communications Corporation
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: NTT Communications Corporation reported a cybersecurity incident affecting approximately 18,000 corporate customers. Hackers compromised the 'Order Information Distribution System,' resulting in the potential theft of customer names, contact details, and service usage information. Despite the security breach discovery on February 5 and the containment of threats, further investigation revealed an attacker's pivot to another network device on February 15, which was also disconnected. NTT's incident response did not include personalized notifications; instead, a public website announcement was made. The breach did not affect contracts for smartphones and mobile phones provided by NTT Docomo.
NTT Communications
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: NTT Communications, a Japanese telecoms service provider, has experienced a significant data breach with unauthorized access detected on February 5th and again on February 15th. The breach has potentially compromised data related to nearly 18,000 corporate customers' mobile phone contracts, including customer names, contacts, phone numbers, email addresses, and information about service usage. This data leak poses a risk to the confidentiality of customer information and could have severe repercussions for those affected.
NTT Data (via Vectorform subsidiary)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The cybercrime group **Coinbase Cartel** targeted **NTT Data**, a Japanese IT services giant, by exploiting vulnerabilities in its US subsidiary **Vectorform** (acquired in 2022). The attack involved **large-scale data exfiltration** without encryption, leveraging exposed credentials in cloud repositories (e.g., AWS, GitHub) and potential insider assistance. While NTT Data denied a direct breach, Vectorform’s systems were compromised, with sensitive operational, client, or proprietary data stolen. Coinbase Cartel employed a **‘leak-only’ ransomware model**, threatening public disclosure to extort payment while avoiding system disruption. The stolen data—likely including logistics, supply chain, or corporate intelligence—poses **reputational, legal, and financial risks**, particularly given the transportation/logistics sector’s reliance on third-party integrations (TMS, WMS, EDI). The breach underscores vulnerabilities in **vendor access controls, credential hygiene, and segmentation**, with the group staging leaks to pressure negotiations. No encryption occurred, but the **theft of high-value data** exposes NTT Data to regulatory scrutiny, customer distrust, and potential litigation, especially if client or employee records were exposed.
NDI Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for NDI
Incidents vs IT Services and IT Consulting Industry Average (This Year)
No incidents recorded for NTT DATA, Inc. in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for NTT DATA, Inc. in 2025.
Incident Types NDI vs IT Services and IT Consulting Industry Avg (This Year)
No incidents recorded for NTT DATA, Inc. in 2025.
Incident History — NDI (X = Date, Y = Severity)
NDI cyber incidents detection timeline including parent company and subsidiaries
NDI Company Subsidiaries
NTT DATA, Inc. is a trusted global innovator of business and technology services. We're committed to helping clients innovate, optimize and transform for long-term success. Our R&D investments help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure, and connectivity.
Loading...
NDI Similar Companies
IGT Solutions
IGT Solutions is a next-gen customer experience (CX) company, defining and delivering AI-led transformative experiences for the global and most innovative brands using digital technologies. With the combination of Digital and Human Intelligence, IGT becomes the preferred partner for managing end-to-
Softtek
Founded in 1982 by a small group of entrepreneurs, Softtek started out in Mexico providing local IT services, and today is a global leader in next-generation digital solutions. The first company to introduce the Nearshore model, Softtek helps Global 2000 organizations build their digital capabilitie
General Dynamics Information Technology
GDIT is a global technology and professional services company that delivers solutions, technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 30,000 experts extract the power of technology to create immediate value and deliver solut
Engineering Group
Engineering Group is the Digital Transformation Company, leader in Italy and expanding its global footprint, with around 14,000 associates and with over 80 offices spread across Europe, the United States, and South America and global delivery. The Engineering Group, consisting of over 70 companies
Hitachi
Since its founding in 1910, Hitachi has responded to the expectations of society and its customers through technology and innovation. Our mission is to “Contribute to society through the development of superior, original technology and products.” Over the past 100+ years this commitment has led us t
SoftwareOne
SoftwareOne is a leading global software and cloud solutions provider that is redefining how companies build, buy and manage everything in the cloud. By helping clients to migrate and modernize their workloads and applications – and in parallel, to navigate and optimize the resulting software and cl
Amadeus
We make the experience of travel better for everyone, everywhere by inspiring innovation, partnerships and responsibility to people, places and planet. Our technology powers the travel and tourism industry. We inspire more connected ways of thinking, centered around the traveler. Our platform c
Indra (www.indracompany.com) is one of the leading global defence, aerospace and technology companies, and a world leader in digital transformation and information technologies in Spain and Latin America through its subsidiary, Minsait. Its business model is based on a comprehensive range of proprie
At Globant, we create the digitally-native products that people love. We bridge the gap between businesses and consumers through technology and creativity, leveraging our experience as an AI powerhouse. We dare to digitally transform organizations and strive to delight their customers. - We have mo
.png)
NDI CyberSecurity News
October 14, 2025 07:00 AM
NTT DATA and Fortanix Announce Global Partnership to Strengthen Security in the AI and Post-Quantum Era
New Cryptography-as-a-Service offering equips enterprises to combat today's cybersecurity threats and prepare for tomorrow's quantum risks.
October 01, 2025 07:00 AM
Cyber Resilience Act: What manufacturers must do
We answer your questions about the Cyber Resilience Act, which sets out new security requirements for connected products imported into or...
September 19, 2025 07:00 AM
CyberCX, Westcon, NTT Data recognised among Palo Alto Networks’ top APJ partners
CyberCX, Westcon and NTT Data have been awarded top regional honours at Palo Alto Networks' 2025 Asia Pacific and Japan (APJ) Partner Awards...
September 11, 2025 04:09 AM
BRUSA HyPower boosts cybersecurity and minimizes compliance risks
BRUSA HyPower AG faced growing challenges due to the increasing threat of cyberattacks, which put their assets and compliance at risk.
September 04, 2025 05:38 PM
5 steps to secure your network from within
Consider this: "Worldwide end-user spending on information security is projected to reach $213 billion in 2025, up from $193 billion in 2024, according to...
August 02, 2025 07:00 AM
NTTDATA-CERT Member Presents Arsenal Session at Black Hat USA 2025
NTT DATA, a global leader in digital business and technology services, today announced that three open-source cybersecurity tools created by...
June 18, 2025 09:20 AM
A CISO's guide to mastering AI risk
AI has elevated cybersecurity from a technological risk into a business risk. Its immense potential for innovation and growth is coupled with new and...
June 18, 2025 07:00 AM
C-Suite Misaligned on Business Goals and Operational Readiness for GenAI: NTT Data
99 per cent of the C-Suite executives surveyed are planning further GenAI investments over the next two years, with 67 per cent of CEOs...
June 17, 2025 07:00 AM
NTT DATA Research Reveals C-Suite Misalignment Over GenAI Adoption
NTT DATA, a global leader in digital business and technology services, today launched its new report, “The AI Security Balancing Act: From...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
NDI CyberSecurity History Information
Official Website of NTT DATA, Inc.
The official website of NTT DATA, Inc. is https://services.global.ntt/.
NTT DATA, Inc.’s AI-Generated Cybersecurity Score
According to Rankiteo, NTT DATA, Inc.’s AI-generated cybersecurity score is 806, reflecting their Good security posture.
How many security badges does NTT DATA, Inc.’ have ?
According to Rankiteo, NTT DATA, Inc. currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does NTT DATA, Inc. have SOC 2 Type 1 certification ?
According to Rankiteo, NTT DATA, Inc. is not certified under SOC 2 Type 1.
Does NTT DATA, Inc. have SOC 2 Type 2 certification ?
According to Rankiteo, NTT DATA, Inc. does not hold a SOC 2 Type 2 certification.
Does NTT DATA, Inc. comply with GDPR ?
According to Rankiteo, NTT DATA, Inc. is not listed as GDPR compliant.
Does NTT DATA, Inc. have PCI DSS certification ?
According to Rankiteo, NTT DATA, Inc. does not currently maintain PCI DSS compliance.
Does NTT DATA, Inc. comply with HIPAA ?
According to Rankiteo, NTT DATA, Inc. is not compliant with HIPAA regulations.
Does NTT DATA, Inc. have ISO 27001 certification ?
According to Rankiteo,NTT DATA, Inc. is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of NTT DATA, Inc.
NTT DATA, Inc. operates primarily in the IT Services and IT Consulting industry.
Number of Employees at NTT DATA, Inc.
NTT DATA, Inc. employs approximately 58,499 people worldwide.
Subsidiaries Owned by NTT DATA, Inc.
NTT DATA, Inc. presently has no subsidiaries across any sectors.
NTT DATA, Inc.’s LinkedIn Followers
NTT DATA, Inc.’s official LinkedIn profile has approximately 1,082,339 followers.
NAICS Classification of NTT DATA, Inc.
NTT DATA, Inc. is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.
NTT DATA, Inc.’s Presence on Crunchbase
No, NTT DATA, Inc. does not have a profile on Crunchbase.
NTT DATA, Inc.’s Presence on LinkedIn
Yes, NTT DATA, Inc. maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/global-ntt.
Cybersecurity Incidents Involving NTT DATA, Inc.
As of December 11, 2025, Rankiteo reports that NTT DATA, Inc. has experienced 3 cybersecurity incidents.
Number of Peer and Competitor Companies
NTT DATA, Inc. has an estimated 37,490 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at NTT DATA, Inc. ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Breach.
How does NTT DATA, Inc. detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with disconnection of compromised devices, and communication strategy with public website announcement, and containment measures with enforce least-privilege access for tms/wms/edi systems, containment measures with disable legacy email protocols (imap/pop3), containment measures with implement phishing-resistant mfa, and remediation measures with deploy data loss prevention (dlp) for microsoft 365/google drive/email, remediation measures with monitor/block mass downloads via service accounts, remediation measures with configure alerts for mailbox forwarding rules and bulk compression, remediation measures with enhance edr coverage for admin/remote hosts, and network segmentation with recommended to limit lateral movement, and enhanced monitoring with behavioral analytics for anomalies, enhanced monitoring with oauth grant monitoring..
Incident Details
Can you provide details on each incident ?
Title: NTT Communications Corporation Data Breach
Description: NTT Communications Corporation reported a cybersecurity incident affecting approximately 18,000 corporate customers. Hackers compromised the 'Order Information Distribution System,' resulting in the potential theft of customer names, contact details, and service usage information. Despite the security breach discovery on February 5 and the containment of threats, further investigation revealed an attacker's pivot to another network device on February 15, which was also disconnected. NTT's incident response did not include personalized notifications; instead, a public website announcement was made. The breach did not affect contracts for smartphones and mobile phones provided by NTT Docomo.
Date Detected: 2023-02-05
Date Resolved: 2023-02-15
Type: Data Breach
Attack Vector: Compromise of Order Information Distribution System
Threat Actor: Unknown Hackers
Motivation: Data Theft
Title: NTT Communications Data Breach
Description: NTT Communications, a Japanese telecoms service provider, has experienced a significant data breach with unauthorized access detected on February 5th and again on February 15th. The breach has potentially compromised data related to nearly 18,000 corporate customers' mobile phone contracts, including customer names, contacts, phone numbers, email addresses, and information about service usage. This data leak poses a risk to the confidentiality of customer information and could have severe repercussions for those affected.
Date Detected: 2023-02-052023-02-15
Type: Data Breach
Title: Coinbase Cartel Data Exfiltration Campaign Targeting Transportation and Logistics Sectors
Description: A new cybercrime group, 'Coinbase Cartel,' has emerged with a focus on data exfiltration (leak-only model) rather than traditional ransomware encryption. The group targets transportation, logistics, and adjacent sectors, exploiting exposed credentials, insider threats, and weak segmentation to steal high-value operational and shipment data. Victims are pressured through staged data leaks and extortion threats, with no disruption to operations, making detection difficult. Confirmed or claimed victims include NTT Data (potentially via subsidiary Vectorform). The group operates with a 'business-like' approach, including partnerships with insiders and staged evidence packages.
Date Detected: 2023-09-15
Date Publicly Disclosed: 2023-09-15
Type: Data Breach
Attack Vector: Exploiting exposed/hard-coded credentials in cloud/source code repositories (AWS, Bitbucket, GitHub)Insider-assisted accessWeak network segmentationThird-party vendor compromises (e.g., TMS, WMS, EDI systems)Staged data leaks for extortion pressure
Vulnerability Exploited: Poor credential hygiene (hard-coded/exposed credentials)Lack of least-privilege access controlsAbsence of phishing-resistant MFAUnmonitored mass data downloads/email exfiltrationLegacy email protocols (IMAP/POP3)Insufficient DLP and behavioral analytics
Threat Actor: Coinbase Cartel
Motivation: Financial Gain (Extortion)Reputational DamageOperational Disruption (via data leaks)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Exposed credentials in cloud repositoriesInsider access (crowdsourced)Third-party vendor compromises (e.g. and Vectorform).
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach NTT1055030725
Data Compromised: Customer names, Contact details, Service usage information
Systems Affected: Order Information Distribution SystemAnother Network Device
Incident : Data Breach NTT030031025
Data Compromised: Customer names, Contacts, Phone numbers, Email addresses, Information about service usage
Incident : Data Breach NTT0902709102325
Data Compromised: Operational data, Shipment data, High-value corporate data (potentially pii)
Systems Affected: Transportation Management Systems (TMS)Warehouse Management Systems (WMS)EDI linksCloud repositories (AWS, Bitbucket, GitHub)Email systems (Microsoft 365, Google Drive)
Downtime: None (no encryption or operational disruption)
Operational Impact: Reputational risk from staged data leaksLegal/regulatory exposurePotential supply chain disruptions if vendor data is compromised
Brand Reputation Impact: High (public extortion threats and staged leaks)Loss of trust in supply chain integrity
Legal Liabilities: Potential GDPR/CCPA violations if PII is exposedContractual breaches with third-party vendors
Identity Theft Risk: Possible (if PII is exfiltrated)
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Names, Contact Details, Service Usage Information, , Customer Names, Contacts, Phone Numbers, Email Addresses, Information About Service Usage, , Operational Data, Shipment Data, Source Code (Potential), Corporate Emails, Potentially Pii and .
Which entities were affected by each incident ?
Incident : Data Breach NTT1055030725
Entity Name: NTT Communications Corporation
Entity Type: Corporation
Industry: Telecommunications
Customers Affected: 18000
Incident : Data Breach NTT030031025
Entity Name: NTT Communications
Entity Type: Telecom Service Provider
Industry: Telecommunications
Location: Japan
Customers Affected: 18,000
Incident : Data Breach NTT0902709102325
Entity Name: NTT Data
Entity Type: IT Services
Industry: Technology
Location: Japan (global operations)
Size: Large enterprise
Incident : Data Breach NTT0902709102325
Entity Name: Vectorform (subsidiary of NTT Data)
Entity Type: IT Services/Software Development
Industry: Technology
Location: United States
Incident : Data Breach NTT0902709102325
Entity Name: Unnamed transportation/logistics companies (multiple continents)
Entity Type: 3PL Providers, Carriers, Brokers, Customs Agents
Industry: Transportation and Logistics
Location: Global
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach NTT1055030725
Containment Measures: Disconnection of Compromised Devices
Communication Strategy: Public Website Announcement
Incident : Data Breach NTT0902709102325
Containment Measures: Enforce least-privilege access for TMS/WMS/EDI systemsDisable legacy email protocols (IMAP/POP3)Implement phishing-resistant MFA
Remediation Measures: Deploy Data Loss Prevention (DLP) for Microsoft 365/Google Drive/emailMonitor/block mass downloads via service accountsConfigure alerts for mailbox forwarding rules and bulk compressionEnhance EDR coverage for admin/remote hosts
Network Segmentation: ['Recommended to limit lateral movement']
Enhanced Monitoring: Behavioral analytics for anomaliesOAuth grant monitoring
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach NTT1055030725
Type of Data Compromised: Customer names, Contact details, Service usage information
Number of Records Exposed: 18000
Personally Identifiable Information: Customer NamesContact Details
Incident : Data Breach NTT030031025
Type of Data Compromised: Customer names, Contacts, Phone numbers, Email addresses, Information about service usage
Number of Records Exposed: 18,000
Incident : Data Breach NTT0902709102325
Type of Data Compromised: Operational data, Shipment data, Source code (potential), Corporate emails, Potentially pii
Sensitivity of Data: High (operational integrity, supply chain data)
Data Exfiltration: Confirmed (staged leaks)Mass downloads via cloud/email
Data Encryption: None (leak-only model)
File Types Exposed: ZIP archives (bulk compression)EmailsDatabase exportsSource code
Personally Identifiable Information: Possible (not confirmed)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Deploy Data Loss Prevention (DLP) for Microsoft 365/Google Drive/email, Monitor/block mass downloads via service accounts, Configure alerts for mailbox forwarding rules and bulk compression, Enhance EDR coverage for admin/remote hosts, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disconnection of compromised devices, , enforce least-privilege access for tms/wms/edi systems, disable legacy email protocols (imap/pop3), implement phishing-resistant mfa and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Data Breach NTT0902709102325
Ransomware Strain: N/A (leak-only, no encryption)
Data Encryption: None
Data Exfiltration: Primary tactic
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach NTT0902709102325
Regulations Violated: Potential GDPR (if EU data exposed), CCPA (if California residents affected), Industry-specific data protection laws,
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach NTT0902709102325
Lessons Learned: Leak-only extortion models bypass traditional ransomware defenses (no encryption = no operational disruption but high reputational risk)., Third-party vendors (e.g., Vectorform) can serve as attack vectors for larger targets (e.g., NTT Data)., Insider threats are actively crowdsourced by groups like Coinbase Cartel., Complex supply chains (transportation/logistics) create expansive attack surfaces.
What recommendations were made to prevent future incidents ?
Incident : Data Breach NTT0902709102325
Recommendations: Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Implement DLP controls to prevent mass data exfiltration via email/cloud services., Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements)., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Leak-only extortion models bypass traditional ransomware defenses (no encryption = no operational disruption but high reputational risk).,Third-party vendors (e.g., Vectorform) can serve as attack vectors for larger targets (e.g., NTT Data).,Insider threats are actively crowdsourced by groups like Coinbase Cartel.,Complex supply chains (transportation/logistics) create expansive attack surfaces.
References
Where can I find more information about each incident ?
Incident : Data Breach NTT0902709102325
Source: Media investigation (unnamed)
Incident : Data Breach NTT0902709102325
Source: Coinbase Cartel darknet leak site
Incident : Data Breach NTT0902709102325
Source: NTT Data public statement (denial of confirmed breach)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Media investigation (unnamed), and Source: Coinbase Cartel darknet leak site, and Source: NTT Data public statement (denial of confirmed breach).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach NTT0902709102325
Investigation Status: Ongoing (group active as of latest reports)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Website Announcement.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach NTT0902709102325
Entry Point: Exposed Credentials In Cloud Repositories, Insider Access (Crowdsourced), Third-Party Vendor Compromises (E.G., Vectorform),
High Value Targets: Tms/Wms/Edi Systems, Supply Chain Data, Corporate Emails,
Data Sold on Dark Web: Tms/Wms/Edi Systems, Supply Chain Data, Corporate Emails,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach NTT0902709102325
Root Causes: Poor Credential Management (Hard-Coded/Exposed Credentials In Repositories)., Lack Of Segmentation Between Subsidiaries (E.G., Vectorform → Ntt Data)., Insufficient Monitoring For Data Exfiltration (No Dlp/Behavioral Alerts)., Over-Reliance On Third-Party Vendors With Weak Security Postures.,
Corrective Actions: Mandate Mfa And Least-Privilege Access For All Systems., Isolate High-Value Systems (Tms/Wms) From Third-Party Networks., Deploy Dlp And Edr With Behavioral Analytics For Exfiltration Detection., Audit Cloud Repositories For Exposed Credentials.,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Behavioral Analytics For Anomalies, Oauth Grant Monitoring, .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Mandate Mfa And Least-Privilege Access For All Systems., Isolate High-Value Systems (Tms/Wms) From Third-Party Networks., Deploy Dlp And Edr With Behavioral Analytics For Exfiltration Detection., Audit Cloud Repositories For Exposed Credentials., .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Unknown Hackers and Coinbase Cartel.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2023-02-05.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-09-15.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2023-02-15.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Customer Names, Contact Details, Service Usage Information, , customer names, contacts, phone numbers, email addresses, information about service usage, , Operational data, Shipment data, High-value corporate data (potentially PII) and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Order Information Distribution SystemAnother Network Device and Transportation Management Systems (TMS)Warehouse Management Systems (WMS)EDI linksCloud repositories (AWS, Bitbucket, GitHub)Email systems (Microsoft 365, Google Drive).
Response to the Incidents
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Disconnection of Compromised Devices and Enforce least-privilege access for TMS/WMS/EDI systemsDisable legacy email protocols (IMAP/POP3)Implement phishing-resistant MFA.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were High-value corporate data (potentially PII), customer names, phone numbers, Shipment data, contacts, Operational data, Customer Names, email addresses, Service Usage Information, information about service usage and Contact Details.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 18.2K.
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Complex supply chains (transportation/logistics) create expansive attack surfaces.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Monitor for anomalies like bulk ZIP file creation, OAuth abuses, and mailbox forwarding rules., Enforce least-privilege access and phishing-resistant MFA across all systems (especially TMS/WMS/EDI)., Deploy behavioral analytics to detect subtle signs of data staging (e.g., unusual compression activities)., Conduct regular insider threat awareness training to mitigate crowdsourced collusion risks., Segment networks to limit lateral movement from compromised vendors/subsidiaries., Audit third-party vendor security postures and include cybersecurity clauses in contracts (e.g., breach notification requirements). and Implement DLP controls to prevent mass data exfiltration via email/cloud services..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are NTT Data public statement (denial of confirmed breach), Coinbase Cartel darknet leak site and Media investigation (unnamed).
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (group active as of latest reports).
Initial Access Broker
.png)
Latest Global CVEs (Not Company-Specific)
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
Risk Information
cvss4
Base: 6.9
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Risk Information
cvss3
Base: 9.4
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Description
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
Risk Information
cvss3
Base: 8.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
Risk Information
cvss3
Base: 5.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=global-ntt' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
