The Japan Times Confirms Eclipse Ransomware Attack: 20 Years of Data From a Retired Server Is Now Public

The Japan Times ransomware attack is now confirmed, and the real story is worse than the first disclosure suggested. On October 15, data the attackers claim to have stolen from a retired file server — holding HR and business-partner information spanning 2001 to 2022 — was published on an external website. The newspaper's parent company, News2u Holdings, said so in a second report on October 16 (updated October 19). Subscriber databases, payment systems, and the website itself were not affected.

The timeline, in order

The sequence of events, drawn from the company's statements and ransomware trackers:

• September 18: the attack is first detected on a server managed by a group company.
• ~September 30: the ransomware group Eclipse lists The Japan Times on its leak site, threatening to publish data unless the company makes contact. The listing was tracked by Ransomware.live.
• October 2: the company publicly discloses unauthorized access to group-company servers.
• October 15: data the attackers claim to have stolen is published on an external website.
• October 16: a second report confirms it was ransomware and names the affected server and data window.
• October 19: the second report is updated with further detail.

Note that trackers like BreachHistory initially logged the leak-site listing as an unverified claim — a good reminder that ransomware leak sites are the attacker's marketing channel, not an independent source. The Japan Times' second report is the authoritative statement here.

What the Japan Times ransomware attackers actually took

The server at the center of this is an administrative file server the group stopped using in August 2022 — and never wiped. The data that leaked potentially covers everything on it from 2001 through 2022, including human resources information and data tied to business partners.

Read that again: a server retired four years ago was still holding two decades of corporate data, and it became a 2026 breach.

The company says The Japan Times Online, its subscriber databases, and its payment systems run on separate infrastructure and were not touched. The paper and website are operating normally. It has also engaged an outside specialist firm to investigate the scope. And to clear up one point of confusion: this has nothing to do with Times Car, the car-sharing service whose breach was disclosed the week before — different company, same word in the name. It's one of the busier items in October's breach wave.

The infostealer trail behind the breach

How did Eclipse get in? The company's reports don't say. But tracker intelligence — cited in security writeups drawing on Hudson Rock-linked data — connects the incident to infostealer activity: the "Cavalier" stealer family on employee systems, with roughly 2,672 passwords (9 marked critical) and 10,609 cookies (68 marked critical) captured, alongside a handful of compromised employee and third-party credentials.

Treat those figures with care: they come from tracker blogs and threat-intel vendors, not from The Japan Times. But the pattern is the classic ransomware playbook — a stolen credential or session cookie gets the attacker inside, data gets exfiltrated first, encryption follows, and the leak site becomes the lever for a second ransom demand. Double extortion has been Eclipse's standard move across its roughly two dozen listed victims.

Who should actually worry

The risk here concentrates on three groups:

• Former employees (2001–2022): your HR information may be in the published data. Watch for a notice from the group, and be extra skeptical of anything asking for personal details.
• Business partners who worked with the group before August 2022: company details may be exposed. The classic follow-on is impersonation — especially emails asking you to "update" payment details. Verify through a channel you trust.
• Subscribers: the company says your systems were not affected, so the real threat to you is opportunistic phishing that uses the breach as bait. Never hand over personal or payment details over a link in a breach-themed email.

If your data was in the published set, here's what to do after a data breach — credit monitoring, credential rotation, and watchful skepticism about inbound requests.

The lesson nobody wants to learn twice

Decommissioning a server should mean wiping it, not just unplugging it. Data has no expiration date unless someone sets one — and attackers know that retired hardware is where old secrets go to be rediscovered. Every company sitting on a legacy file server should read this incident as a warning: if the data isn't wiped, it isn't gone. The Japan Times' incident is a textbook case of how a forgotten machine from 2022 becomes a 2026 headline, and it won't be the last one.