Japanese firms shut websites over PHP security flaw

Sony Group (TYO: 6758), Nojima (TYO: 7419) and Bandai Namco Holdings (TYO: 7832) were among the Japanese companies that took online services offline while dealing with a vulnerability in the PHP programming language, the Yomiuri Shimbun reported on October 23.

The disruption reached retail, transport and finance. Companies chose to suspend web services before any harm occurred, putting the protection of customer data ahead of convenience as cyberattacks become more frequent.

Sony launched emergency maintenance on the night of October 21 at Sony Store, the online shop selling the group's smartphones and game consoles. Some services were unavailable until around 7pm the next day. The group also shut down the official website of its semiconductor subsidiary.

Electronics retailer Nojima took its official website and online shopping site down at 8:30pm on October 21. It brought them back on the morning of October 22 once it had confirmed they were secure. Bandai Namco began maintenance at about 10pm on October 21, and by 5pm on October 22 parts of its amusement arcade online services and online store were still suspended.

Central Japan Railway halted bookings for the private booth workspaces it operates at major Tokaido Shinkansen stations.

Takahashi, of Tokyo-based security company Trend Micro, said applying software fixes takes some time. He added that the gap in recovery between companies came down largely to whether they had organised staff with the business impact in mind, and that firms which had not prepared for such a scenario would struggle to respond quickly.

Banks and other financial institutions restricted some web services. Payment functions such as deposits, withdrawals and transfers were not affected. Mitsubishi UFJ Morgan Stanley Securities suspended online identity checks and other services from the evening of October 21.

Tokio Marine & Nichido Fire Insurance stopped displaying its website from the early hours of October 22. A spokesperson said the company had emergency patches ready but went offline to avoid damage while the work was carried out. The insurer described the decision as a difficult one. It said it took precautionary action to keep customer data safe and to prevent a prolonged outage.

Another financial industry source said their systems had stayed offline on vendor instructions until the vulnerability was fixed. The source added that preventive shutdowns to stop customer data leaks would become more important.