Toyota Kojima Industries supply-chain cyberattack

On the evening of February 26, 2022, file servers at Kojima Industries Corporation, a Toyota Tier-1 supplier of plastic parts and electronic components, were encrypted in a ransomware-style cyberattack. Initial access reportedly came through an external business-partner connection on a Kojima network appliance with a known vulnerability. With Kojima unable to receive or act on Toyota's just-in-time parts-order interchange the following day, Toyota Motor Corporation announced on February 28 the halt of all 14 of its domestic Japanese plants and 28 production lines, including those operated by subsidiaries Daihatsu Motor and Hino Motors. Production resumed on March 1, 2022 after one full day of stoppage. The lost output was approximately 13,000 vehicles, equivalent to roughly one-third of Toyota's typical Japan-domestic daily production, with order-of-magnitude $375 million in revenue impact. Neither Kojima nor Toyota publicly named the ransomware family or attributed the attack to a specific group.

One-day halt of all 14 Toyota domestic factories and 28 production lines; approximately 13,000 vehicles of lost output; cascading impact on Daihatsu and Hino subsidiaries; Toyota subsequently mandated supplier cybersecurity audits across its Tier-1 base.