SCAT Inc., a developer of management systems for the beauty salon industry, has fallen victim to the unauthorized use of its paid cloud services by a third party. The incident was driven by malicious unauthorized access that exploited vulnerabilities in account management and access credential configurations within their cloud environment.

Detection of Unauthorized Access and Filing of Police Report

On September 4, 2026, SCAT Inc., listed on the Tokyo Stock Exchange (TSE) Standard Market and Nagoya Stock Exchange (NSE) Main Market, announced that the paid cloud services utilized by the company had been unauthorizedly accessed and used by a third party. According to the summary of the incident, SCAT detected signs of unauthorized third-party activity within its paid cloud service contract on August 25, 2026. Subsequent detailed investigations confirmed that unauthorized access had indeed taken place. The abuse is estimated to have occurred over a two-day period, from August 24 to August 25, 2026. Treating the situation with high priority, the company immediately held preliminary consultations with the Metropolitan Police Department and submitted relevant access logs and other materials to assist with the investigation. On September 2, 2026, SCAT formally filed a damage report with the local Mita Police Station, which has since been accepted.

Investigation Into Personal Data Leaks and Impact on Business Performance

As of the announcement on September 4, 2026, there has been no concrete evidence suggesting that sensitive data, such as customer personal information or confidential business data hosted on SCAT’s systems and services, was leaked externally. Since SCAT’s core business centers on beauty ICT solutions—providing customer and sales management systems to numerous beauty salons across Japan through seven regional offices—the handling of such data requires the utmost vigilance. Regarding the excess usage fees incurred due to this cloud abuse, the company is currently in negotiations with the cloud service provider. SCAT is also thoroughly evaluating the specific impact of this incident on its consolidated business performance and future outlook. The company stated that it will promptly disclose any further reportable matters as they arise.

The Risks of Cloud Service Abuse and Misconfigurations

Mechanisms and Mitigations of Paid Cloud Resource Theft

Unauthorized cloud resource usage is frequently triggered by system misconfigurations or inadequate identity and account management. According to guidelines published by the Ministry of Internal Affairs and Communications (MIC), cloud misconfigurations are a major factor driving data leaks and resource abuse. A survey by the Information-technology Promotion Agency (IPA) in Japan ranks misconfigurations as the third most common cause of unauthorized access, accounting for approximately 17.7% of all incidents. Malicious actors actively target systems by seeking out exposed, publicly accessible cloud storage, weak accounts lacking encryption or multi-factor authentication (MFA), and leaked access keys. In particular, when paid computing resources or development environments are compromised, organizations face significant financial damage from cloud billing fraud. Consequently, it is crucial for cloud users to establish continuous monitoring systems capable of detecting anomalous traffic and sudden spikes in usage fees during normal operations. Please refer to the diagram below.

The Shared Responsibility Model and User-Side Configuration Management

When utilizing cloud services, understanding the Shared Responsibility Model is of paramount importance. In cloud computing—regardless of the service model, whether IaaS, PaaS, or SaaS—responsibility for security is clearly divided between the cloud provider and the user. Generally, the service provider is responsible for “security of the cloud,” which encompasses the physical infrastructure and the security of the host network. Conversely, the user is entirely responsible for “security in the cloud,” including access control configurations, data encryption, and account password management. A 2021 study by McKinsey & Company revealed that over 95% of cloud security incidents are caused by user-side configuration errors rather than issues on the provider side. Therefore, utilizing organizations must avoid relying on default settings and must strictly enforce robust access controls based on the principle of least privilege.

Future Preventive Measures and Security Enhancements

Initial Response and Access Privilege Review by SCAT

Upon discovering the unauthorized use, SCAT Inc. took immediate containment actions to prevent further damage. The company promptly blocked all unauthorized external access paths to the affected cloud services and initiated password resets for all administrative and user accounts. Additionally, working in close coordination with the cloud service provider, SCAT is continuing its comprehensive investigation to identify the exact intrusion vector and the scope of the impact. As part of its long-term remediation strategy, SCAT has initiated a full-scale audit and review of access privileges across its entire systems. By deleting unnecessary privileged accounts, strictly segregating development and production environments, and strengthening authentication settings, the company aims to rebuild a robust governance framework that eliminates entry points for malicious actors.

Establishing Continuous Organization-Wide Monitoring Systems

Maintaining cloud security requires a continuous monitoring and evaluation framework that operates on a Plan-Do-Check-Act (PDCA) cycle, rather than treating configuration as a one-time setup. As highlighted in the MIC guidelines, manually managing increasingly complex cloud environments is highly challenging. Therefore, organizations are strongly encouraged to adopt Cloud Security Posture Management (CSPM) tools to automate configuration scanning and compliance auditing, and to conduct periodic vulnerability assessments by external security specialists. Furthermore, enabling detailed logging and monitoring to instantly detect and alert on suspicious logins or configuration changes is fundamental to ensuring a rapid response in the event of a breach. As demonstrated by the SCAT incident, establishing a robust, organization-wide, round-the-clock monitoring architecture capable of catching early warning signs of abuse is a critical step forward for modern enterprises.

References

• 【SCAT Inc. Timely Disclosure】Notice Regarding Unauthorized Use of Paid Cloud Services by a Third Party (First Report)
  https://contents.xj-storage.jp/xcontents/AS80344/c92d3897/982b/4350/bcf3/b2915d0f621f/140120260904531534.pdf

• 【Ministry of Internal Affairs and Communications (MIC)】Guidelines for Appropriate Configurations in Cloud Service Usage and Provision
  https://www.soumu.go.jp/main_sosiki/cybersecurity/telework/

【#Cybersecurity #CloudSecurity #UnauthorizedAccess #Misconfiguration #InformationSecurity #Technology】