On March 27, 2026, a ransomware infection hit servers at COTA CO., LTD. (TSE: 4923), the Kyoto-based maker of salon-exclusive hair-care and quasi-drug products sold only through hair salons. The company disconnected every server from its network to contain the damage, then found it could not retrieve the data needed to close its books, forcing months of manual accounting work. The disruption, combined with longer-than-usual audit procedures, pushed COTA's securities report for the year to March 2026 past its normal deadline. Regulators approved an extension to September 30, and the company filed on August 31, a month ahead of that extended date.
The direct financial hit was small: COTA booked a ¥27mn extraordinary charge for incident-response costs, and selling expenses actually fell year on year after the company cancelled sales events in the aftermath. The bigger consequence showed up in COTA's internal-control report, where the company concluded that its company-wide controls and IT general controls contained a "material weakness" that should be disclosed, and that internal control over financial reporting was not effective as of March 31, 2026. COTA said it had cybersecurity measures in place before the attack but that its risk assessment and countermeasures were insufficient.
Because the weakness only became apparent on the day of the attack, four days before fiscal year-end, COTA had no chance to fix it before the books closed. The financial statements themselves carried only the ¥27mn incident-response charge already booked: the company's auditor issued an unqualified opinion, and COTA says the disclosed control weakness had no further impact on the year's financial statements. Fixes underway include forensic tracing of how the attackers got in, patching the vulnerabilities they found, and tighter network monitoring, and next year's spending plan already carries extra costs for cybersecurity.