Nikki-Universal Co Ltd targeted by Hunters ransomware group

• Ransomware group: Hunters
• Country: Japan
• Sector: Manufacturing
• Announcement date: January 3, 2025

Hunters ransomware group claims attack on Nikki-Universal Co Ltd

The ransomware group known as Hunters has listed the Japanese manufacturing firm Nikki-Universal Co Ltd on its leak site. According to the group's announcement, the company's data has been both exfiltrated and encrypted during a recent cyberattack. This claim follows a pattern often seen in modern ransomware operations, where threat actors move beyond simple encryption to a method known as double extortion. In such scenarios, attackers not only lock the victim's systems but also steal sensitive information to use as leverage for extortion.

The group has asserted that the attack occurred on January 3, 2025. Furthermore, the Hunters group claims that the organization has failed to respond to their communications. As a consequence of this perceived silence, the attackers have issued a warning: all acquired data will be published publicly once a 168-hour deadline has expired. This tactic is a common pressure mechanism used by ransomware groups to force organizations into compliance through the threat of public exposure.

Details of the alleged data breach

The claims made by the Hunters group regarding the volume of stolen information are significant. Based on the group's announcement and accompanying screenshots, the breach involves a substantial amount of data. The group alleges that the compromised dataset consists of the following:

• Total data size of 761.8 GB
• A total of 476,342 files

While the specific categories of the stolen files have not been explicitly detailed by the group, the announcement implies that the compromised set may include sensitive information regarding the company's employees. The lack of specific file types or a defined ransom demand means that the full scope of the internal impact remains unconfirmed, though the sheer volume of data suggests a broad intrusion into the corporate network.

About Nikki-Universal Co Ltd

Nikki-Universal Co., Ltd. is a manufacturing company based in Japan. The organization operates primarily in the production and supply of industrial equipment, machinery parts, and technical components. Given its role in the supply chain for industrial and technical components, the company serves as a critical link in the manufacturing sector.

Potential risks and organizational implications

The claims made by the Hunters group pose significant risks to the operational continuity and data privacy of Nikki-Universal Co Ltd. Depending on the actual nature of the exfiltrated data, there is a high potential for the exposure of corporate trade secrets and the personal information of employees. Such an exposure can lead to various secondary risks, including identity theft and highly targeted phishing attacks against the organization and its staff.

From a regulatory perspective, the company may face legal obligations under Japan's Act on the Protection of Personal Information (APPI) due to the potential exposure of personal data. Organizations in the manufacturing sector facing such threats often prioritize incident response protocols, such as isolating affected systems, conducting forensic investigations, and reviewing access controls to prevent further unauthorized exfiltration.

Regarding the threat actor, information concerning the Hunters group remains limited. While they are actively claiming responsibility for this incident, some reports have suggested that the group may have ceased encryption activities in 2025. If these reports are accurate, it could indicate a potential shift in the group's operational tactics, moving away from traditional encryption toward pure data exfiltration and extortion.