On June 8, 2024, Kadokawa Corporation and its Dwango subsidiary, which operates Japan’s Niconico video platform, suffered a ransomware attack that disrupted websites, streaming services, publishing operations, e-book distribution, and Kadokawa’s online shop. Kadokawa reported the incident to police and regulators on June 9. Investigators found that attackers restarted servers remotely despite shutdown attempts, forcing the company to physically disconnect power and network cables. Niconico canceled scheduled programming through the end of July, while its main services did not return until August 5; Kadokawa’s stock price had fallen more than 20% by July 3.
On June 27, the Russian-linked BlackSuit ransomware group claimed responsibility and threatened to release 1.5 terabytes of allegedly stolen business-partner and user data. Kadokawa warned on July 10 that distributing leaked information could trigger legal action. In an August 6 investigation, Kadokawa said phishing was a possible entry point and confirmed that information belonging to 254,241 people had been exposed, including 186,269 individuals connected to the Kadokawa Dwango Educational Institute. On December 12, Kadokawa executives received an email from BlackSuit claiming the company had paid $2.9 million in cryptocurrency. Kadokawa rebuilt systems and introduced additional security measures after the breach.
