Ushio listed on Termite ransomware leak site

• Ransomware group: Termite
• Country: Japan
• Sector: Manufacturing
• Announcement date: April 29, 2025

Termite claims data breach at Ushio

The threat group known as Termite has listed the Japanese technology company Ushio on its leak site. According to the announcement made on April 29, 2025, the group claims to have gained access to Ushio's systems. This claim follows an alleged attack date of April 28, 2025. The threat actor asserts that they hold evidence of a breach, despite the organization's public denials regarding such an incident.

The group has stated that their intention to publish the stolen data stems from a refusal to negotiate. Because the organization has reportedly declined to engage in negotiations with the attackers, the group has threatened to release approximately 370 GB of data. Publicly available information regarding the Termite group remains limited, making it difficult to establish a comprehensive profile of their specific operations or motivations beyond this recent claim.

Details of the alleged data theft

The threat group claims to be in possession of a significant volume of information, totaling approximately 370 GB. This data is said to consist of roughly 340,000 files. To support their claims, the group provided screenshots as part of the leak announcement, which reportedly display samples of spreadsheets containing financial reports and budget data.

According to the claims made by the attackers, the compromised data includes a variety of sensitive information types, such as:

• Financial records
• Emails
• Client data
• Confidential corporate documents

The presence of such diverse data types suggests that the attackers may have targeted various administrative and operational repositories within the organization's network.

About Ushio

Ushio is a global technology company specializing in specialty lighting solutions. Their product range extends from ultraviolet to infrared technologies. The company focuses on the development and manufacturing of light sources and equipment designed for use in industrial, medical, and visual systems.

Potential implications and security considerations

This incident may have negative implications for the organization's operational continuity and commercial reputation. The alleged exposure of client information could lead to regulatory scrutiny under Japanese data protection laws and other applicable frameworks, such as the General Data Protection Regulation (GDPR). Furthermore, the disclosure of sensitive employee and client data may increase the risk of secondary attacks, including identity theft and targeted phishing campaigns.

The group's threat to release data following a failed negotiation process is consistent with double-extortion tactics. In a double-extortion scenario, ransomware actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to leak the data publicly, the attackers aim to pressure the victim into paying a ransom to prevent the reputational and legal damage associated with a data leak.

For organizations operating in the manufacturing and technology sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with international data protection standards can help mitigate the impact of such targeted campaigns.