Initial Disclosure Date: Jan 23, 2014

On January 21, Japan'sNational Agriculture and Food Research Organization (NARO) and National Institute of Agrobiological Sciences (NIAS) announced that their email account was hijacked to send a large amount of spams. Both of the organizations claimed that they had cancelled the accounts and had confirmed no leak of patent-associated or sensitive information so far.

NARO's 35-years old researcher happened to access a malicious website whose link was in an English phishing email to request him to expand his email server. He typed his work account's ID and password sometime after December 25th, 2013. On December 31, a large amount of English spams were sent out from his email account to claim that the organization was looking for project partners. The messages also included a contact email address.

NIAS found out on January 6 that one of their employee's email account had been hijacked and a lot of spams were sent from that account between January 2nd and 6th. He also received a similar phishing email and the spams were similar to NARO’s. On January 6, NIAS cancelled the email account.

Sources:

1. National Agriculture and Food Research Organization, “Press Release: hushin na meru no tairyo soshin jian no hassei nit suite [Press Release: a large amount of spams were sent],” January 21, 2014,
   http://www.naro.affrc.go.jp/publicity_report/press/laboratory/naro/050194.html
2. National Institute of Agrobiological Sciences , “Press Release: hushin na meru no tairyo soshin jian no hassei nit suite [Press Release: a large amount of spams were sent],” January 21, 2014,
   http://www.nias.affrc.go.jp/press/2014/20140121/index.html
3. Kyodo, “ID nusumare meru tairyo soshin Tsukuba, Seibutsuken nado higai [NIAS’s email ID was hijacked and a large amount of spams were sent from it],” January 21, 2014,
   http://www.nikkei.com/article/DGXNASDG2103U_R20C14A1CC1000/
4. Sankei Shimbun, “Akaunto nusumare hushin meru tairyo soshin Nokenkiko to Seibutsuken Ibaragi [NIAS and NARO’s email account was hijacked and a large amount of spams were sent from them],” January 22, 2014,
   http://sankei.jp.msn.com/region/news/140122/ibr14012202520000-n1.htm

※ Each company name, an organization name, and a brand name are a trade name of each company and each organization, or a registered trademark.