For those who prefer to read this column in English, the Japanese text is followed by a British English translation, so please scroll down to the bottom of the Japanese text.

「全世界でサイバー攻撃が激化している」と種々のメディアで報道されている。なかでも急増しているのが、「ランサムウェア」というサーバー攻撃である。

英語の「ランサム」を日本語に翻訳すると「身代金」となる。つまり、企業にサイバー攻撃を仕掛けて、その企業の「機密情報データ」を「人質」にして、使用不能にする、そして、「元に戻すこと」と引き換えに金銭、つまり「身代金」を要求するものである。

米国の主要企業の多くを顧客に持つ大手サイバーセキュリティ企業の発表によると、統計のある「2021年の米国に於けるランサムウェア攻撃」の平均要求額は220万ドル（約3億5000万円）であり、2020年から実に144％増加したとのことである。

これは「ランサム」の金額のみであり、サイバー被害を受けた企業が被った損失額の平均は1500万ドル（約24億円）に及び、事業継続が不可能であった平均日数は平均50日、1ヶ月半となっている。

1．経産省の対応策

政府もこういう事態に対して動き、「経済産業省は、2025年度より『企業のサイバー攻撃対策を格付けする制度』を施行してサイバー攻撃の対応力を高める」との報道がなされた。企業の対策を5段階で評価して、ステークホルダーが「どこまで対策がとられているか」を評価できるようにする主旨である。

2022年2月、大手自動車メーカーに部品を納入しているサプライヤーを狙ったサイバー攻撃によって、大手自動車メーカーの生産がストップしたことから、「本体企業」のみならず、「サプライヤー」を含めたサプライチェーン（供給網）の弱点を狙う攻撃が増えているため、当該産業全体でサイバー攻撃・リスクへの対応力を高めることを目的としたものである。

本年、2024年4月5日付け「日本経済新聞」朝刊には、このことに関して以下のとおりの記事があった；

サイバー対策の度合いを5段階で格付けする。自動車や工場など分野ごとのガイドラインや海外事例をもとに各段階の基準を定める。今後、詳細を検討する。

レベル1〜2は企業に最低限求める対策を指す。①ソフトウエアの定期更新②機密事項へのアクセス制限③情報漏洩時の対応手順――などが基準となる見込みだ。

レベル3〜4は供給網の一端を担う企業向けで強固な情報管理の体制整備などの基準を検討する。レベル3までは企業が自社の状況を確認し、対応度を自己宣言する方式にする。

レベル4〜5の取得には外部の認証団体から、対策状況の第三者認証を受ける仕組みにする。

特にレベル5は電気・ガスや鉄道といった社会インフラ企業や、こうした企業に製品を供給する会社を対象にした基準とする。①攻撃時に官民に情報を迅速共有する②早期復旧に向けた手順を策定する――といった項目を想定する。

経産省は格付けを通じ、企業に自社の取り組みの強化を促すだけでなく、取引先がどれだけサイバー対策の対応力があるかが把握しやすくなるとみる。格付けが低い企業は取引を避けられる可能性があるため、結果的に産業全体で対応力が高まる効果が見込まれる。

2．ランサムウエアの損害

米国の保険専門誌（Business Insurance）によると；

米国の大手の保険ブローカー（代理店）が、2023年「サイバー恐喝事件」の影響を受けた同社の顧客を調査したところ、「ランサム（身代金）」を支払ったのはわずか20%程度であったが、同社の顧客が被ったサイバー攻撃は約2000件、そのうちサイバー恐喝事件の件数は300件近くに前年度から急増した。

これを見ると、「ランサムウエア」の損害は減少しているように見える、「ランサムウエア攻撃を受けた数は減っている」が、「損害額」つまり「保険金支払額」は2022年の約30万ドルから2023年には700万ドルに増加しているとのことである。この傾向によるものか、企業が求める「サイバー保険の総てん補限度額（総保険金支払額）」の平均は、前年の150万ドルから2,000万ドル超に急増した。

ただ、問題は、「ランサム（身代金）」という性質上、「企業はこのような調査に全てを開示して正確に答えているのか」という強い疑問が残る。

今回のまとめ

執筆・翻訳者：羽谷 信一郎

English Translation

Captive (CA) 62 – ‘Cyber-attacks’ scorched earth, Japan

Various media reports indicate that cyber-attacks are intensifying all over the world. One of the most rapidly increasing attacks is a server attack called ‘ransomware’.

The English word ‘ransom’ translates to ‘ransom’. In other words, a cyber-attack is launched against a company, holding its ‘confidential information data’ ‘hostage’, rendering it unusable and demanding money, or ‘ransom’, in exchange for ‘restoring’ it.

According to a major cyber security company, which has many major US companies as clients, the average demand for a ‘ransomware attack in the US in 2021’, for which statistics are available, was USD 2.2 million, an increase of 144% since 2020.

Furthermore, this is only the amount of ‘ransom’, with the average loss suffered by cyber-affected companies amounting to USD 15 million (approximately 2.4 billion yen), and the average number of days that business continuity was impossible was 50 days, or one and a half months on average.

1．METI’s response

The Government of Japan has also moved to address the situation, and it was reported that “the Ministry of Economy, Trade and Industry (METI) will implement a ‘rating system for corporate cyber-attack countermeasures’ from fiscal year 2025 to enhance the ability to respond to cyber-attacks”. The main objective of the system is to rate companies’ countermeasures on a five-point scale so that stakeholders can evaluate ‘how far the measures have been taken’.

In February 2022, a cyber-attack targeting a supplier of parts to a major car manufacturer brought production to a halt at a major car manufacturer, and since attacks targeting weaknesses in the supply chain (supply network), including not only the ‘main company’ but also the ‘supplier’, are increasing, the industry concerned The aim is to improve the ability of the industry as a whole to respond to cyber-attacks and risks.

An article in the morning edition of the Nihon Keizai Shimbun dated 5 April 2024 stated

The degree of cyber countermeasures is rated on a five-point scale. Criteria for each stage will be established based on guidelines for each sector, such as automobiles and factories, as well as overseas examples. Details will be worked out in the future.

Levels 1-2 refer to the minimum measures required of companies. The standards are expected to include: 1) regular software updates; 2) restrictions on access to confidential information; and 3) response procedures in the event of an information leak.

Levels 3-4 are for companies that play a part in the supply chain and will consider criteria such as the development of a robust information management system. Up to Level 3, companies will be required to check their own situation and self-declare their level of response.

To obtain Levels 4-5, companies will be required to obtain third-party certification of their countermeasure status from an external certification body.

Level 5 in particular will be targeted at social infrastructure companies such as electricity, gas and railways, and companies supplying products to these companies. The criteria are expected to include: (1) rapid sharing of information to the public and private sectors in the event of an attack; and (2) formulation of procedures for early restoration.

The Ministry of Economy, Trade and Industry (METI) believes that the ratings will not only encourage companies to strengthen their own initiatives, but also make it easier to understand how well their business partners are dealing with cyber countermeasures. Companies with a low rating may avoid doing business with them, which is expected to have the effect of increasing the industry as a whole’s ability to deal with the issue.

2. Ransomware losses

According to the US insurance magazine (Business Insurance);

A leading US insurance broker (agency) surveyed its clients affected by ‘cyber extortion’ in 2023 and found that while only around 20% paid a ‘ransom’, its clients suffered around 2,000 cyber-attacks, of which 300 were cyber extortion cases. The number of cases had jumped from the previous year to nearly 300.

This suggests that while ‘ransomware’ losses appear to be declining – ‘the number of ransomware attacks suffered appears to be decreasing’ – ‘insurance payouts’ have increased from around USD 300 000 in 2022 to USD 7 million in 2023. Perhaps due to this trend, the average ‘total cyber insurance coverage limit (total claims paid)’ required by companies increased to over USD 20 million from USD 1.5 million in the previous year.

The question remains, due to the nature of ‘ransom’, ‘are these companies answering all these surveys with open arms?

Summary of this issue.

The aforementioned cyber-attack on a supplier of a major car manufacturer overturned the assumption that cyber-attacks occur at very large companies, and this may indicate that cyber-attacks are changing from targeting “one giant company” to targeting “supply chains”.

Instead of targeting “a giant company that has a lot of money and a lot of staff to deal with various cyber-attacks”, cyber-attacks are now targeting “Achilles’ heel” or “companies that seem to have weak supply chains”.

In fact, in the ‘London insurance market’ (London Market), led by Lloyd’s of London, which is renowned as ‘the last stop for global non-life insurance to diversify risk’, the need for cyber insurance has become more diversified, changing from the previous requirement for giant companies only, to a need for many mid-sized companies that are part of the supply chain. A Lloyd’s of London syndicate cyber underwriter I spoke to on the phone yesterday told me that they are seeing a surge in staff moving from other insurance departments to the cyber insurance department as they are receiving more enquiries from companies, many of which are part of the supply chain.

How, on the other hand, are Japanese companies prepared? It’s too late to tell until after it has happened”. Why not get the world’s most advanced cyber insurance from the London market by setting up a captive to cover the “critical risk areas” not covered by the cyber insurance available in Japan?

Author/translator: Shinichiro Hatani