On 1 March 2022 Toyota stopped all 28 lines at its 14 plants in Japan for a day. No record says Toyota was hacked. A parts supplier was, through a remote connection device its own subsidiary kept for an outside firm.
This is an IT compromise that halted physical operations, at one remove. Nothing on the record reached a Toyota system, line, robot or controller. Toyota described a system failure at a supplier; Kojima Industries described ransomware on part of its servers and PCs. Fourteen plants stopped because the parts, and the information that summons them, stopped. Just-in-time is not the flaw. It is why the system is efficient, and it means the buffer is measured in hours.
Kojima’s own report puts the way in at a remote connection device a subsidiary used for one outside company. A door built for one relationship opened onto a supplier feeding fourteen plants. Nobody had to be careless; they only had to be connected the way supply chains are. That is BlastWave’s analysis. Both companies acted well: Kojima never contacted the attacker and organised deliveries on paper boards, and Toyota restarted the next morning over a backup network to the supplier.
What is not known: Kojima names its entry point but not the device, the flaw, the subsidiary or the outside company. No government, Kojima document or claim on the record names an attacker, and Kojima names no malware family. The 13,000 vehicles figure is press; Toyota’s releases give no count. What the day cost either company is undisclosed. Kojima’s first report found no sign of data taken, and no later report was found. That Toyota’s own systems were untouched is reported, not documented.
Recommendation
Take the side door away No remote connection device at a supplier, or at any of its subsidiaries, should answer the internet. Kojima’s report puts the entry at exactly such a device.
Remove standing credential access An outside firm’s connection exists only as a named, multi-factor, time-boxed session, and a subsidiary’s link into its parent is a path someone approves.
Make the order link one-way, build two Carry the carmaker’s production instructions to the supplier in one direction only, and build a backup path before it is needed, as Toyota’s was.
Sources: Toyota releases, 28 Feb and 1 Mar 2022; Kojima notice, 1 Mar 2022; Kojima investigation report (first report), 31 Mar 2022; Toyota Times, 8 Mar 2023; Reuters, 1 Mar 2022 (13,000 vehicles; backup network).. Full list with links.
Soft Spots: The vector is Kojima’s own finding; “partner network” is later press. 13,000 vehicles and Toyota’s backup network are Reuters, not Toyota releases. That nobody in the chain had to be careless is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
Fourteen plants stopped for a day because a parts supplier lost its systems, not because anything at Toyota was reached on any record. What is verified, what is only reported, and what is still unknown.
Summary
On 1 March 2022, Toyota stopped all 28 lines at its 14 plants in Japan for one day after a system failure at parts supplier Kojima Industries, which by its own account had been hit by ransomware through a subsidiary's vulnerable remote connection device. No record says a Toyota system was hacked. The attacker, malware family and cost are undisclosed.1,3,5
Timeline of the Kojima Industries attack and the Toyota shutdown
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Kojima's later investigation finds traces of attack on its servers and PCs from this time.1
Kojima detects a fault on its file server at about 9 p.m.; at about 11 p.m., after a restart, it confirms a virus infection and a threatening message.2
A Kojima response team including outside experts stops the servers, cuts the network and stops all systems. The relevant ministries are informed and the police consulted.2
Toyota announces it will suspend 28 lines at 14 plants in Japan on 1 March, both shifts, "due to a system failure at a domestic supplier." The same day, Reuters quotes the prime minister declining to link the incident to Russia before thorough checks.3,9
All 28 lines at 14 domestic plants stand for both shifts. Toyota says it will resume from the first shift the next day. Reuters reports the suspension hit output of around 13,000 vehicles and that Toyota would resume by tapping into a backup network between it and the supplier.4,5
Toyota's plants resume from the first shift. Toyota's own publication later records that the shutdown "lasted only one day."5,10
Kojima provisionally restores its website and resumes mail after reinforcing and confirming the security of its mail server and all PCs.11
Kojima publishes its first investigation report, naming the entry point: a subsidiary's remote connection device with a vulnerability.1
Toyota's annual report to the SEC adds a risk-factor sentence that attacks on its suppliers and business partners "have had" a negative impact on Toyota. It names no supplier and no date.12
Toyota Times describes Kojima's fallback: paper boards for delivery destinations and times, and blueprints sorted and distributed by hand.10
Bloomberg writes that hackers penetrated the systems of "a third-party business partner" and gives a figure of about $375 million, based on its own rough calculation of sales and output data.8
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What did Toyota stop?
All 28 lines at 14 plants in Japan, both shifts, on 1 March 20223,5
Verified
What reason did Toyota give?
"A system failure at a domestic supplier" (Kojima Industries)3
Verified
Was a Toyota system hacked?
No record says so. "No abnormality" in Toyota's own systems is Yomiuri as cited, not a Toyota statement3,7
Reported only
What happened at Kojima?
Ransomware encrypted data on part of its servers and PCs1
Verified
How did the attacker get in?
A vulnerable remote connection device a subsidiary used for dedicated communication with one outside company1
Verified (victim's own finding)
Which device, flaw, subsidiary and outside company?
Not named
Undisclosed
Who was the attacker?
Not named by any government, Kojima or Toyota; no leak-site claim found as of 28 September 20261,6
The threatening message stated no specific ransom amount, and Kojima did not contact the attacker1
Verified
Was data taken?
No trace found in Kojima's first report, 31 March 2022; no later report was found1
Verified (time-bound)
Vehicles lost
Around 13,000, per Reuters and Nikkei; no count in Toyota's releases4,5,7
Reported only
Cost of the incident
Not disclosed by Toyota or Kojima
Undisclosed
Was Toyota hacked in 2022?
No record says Toyota was hacked; its supplier Kojima Industries was. Toyota's announcement of 28 February 2022 gave one reason, in one sentence:
"Due to a system failure at a domestic supplier (KOJIMA INDUSTRIES CORPORATION), we have decided to suspend the operation of 28 lines at 14 plants in Japan on Tuesday, March 1st (both 1st and 2nd shifts)."
Neither of Toyota's releases mentions a cyberattack, and neither gives a vehicle count.3,5 The Yomiuri newspaper, as compiled by the Japanese security blog piyolog, reported no abnormality in Toyota's own systems.7 That is press, not a Toyota statement, so the accurate summary is narrower than "Toyota was not hacked": no record says Toyota was, and that Toyota's own systems were untouched is reported, not documented.
No record mentions a robot, a PLC, a controller or any movement from Kojima into Toyota's network. Kojima's report places the encrypted machines among its own servers and PCs.1
Why did 14 Toyota plants stop if Toyota's systems were not hit?
In BlastWave's reading, because the parts, and the information that calls them, stopped at the supplier. Toyota builds just in time, and in BlastWave's description the buffer on such a line is measured in hours. Toyota Times notes that a single missing component prevents a car from being assembled, which supports this reading, though it does not say it about the order system.10 That the lines stopped for want of the supplier's parts and order flow, rather than anything on the line, is BlastWave's analysis rather than a disclosed fact.
Both companies had fallbacks, and they decided the length of the stoppage. Toyota said it would resume operation by "tapping into a back-up network between it and the supplier," as Reuters reported on 1 March 2022, and that it would need "a week or two to fully restore the system."4 At Kojima, Toyota's own publication describes paper pinup boards for delivery destinations and times, and boxes of blueprints sorted and distributed by hand.10
"lasted only one day, with systems almost fully restored within a month"
Toyota Times also records that President Akio Toyoda visited Kojima's headquarters four days after the attack.10
How did the attackers get into Kojima Industries?
Through a vulnerable remote connection device that a Kojima subsidiary kept for one outside company, by Kojima's own account. Kojima's first investigation report, published 31 March 2022, says:
"a remote connection device that a subsidiary used independently for dedicated communication with a specific outside company had a vulnerability, which led to the unauthorised access"
The report says the attacker went from that device into the subsidiary's network, and from there into Kojima's. Ransomware encrypted data on part of Kojima's servers and PCs. The threatening message stated no specific ransom amount, Kojima did not contact the attacker, and the report found no trace of information taken out. Kojima cut its network off from customers and the outside, engaged outside security experts, consulted the police, and restored systems as each was confirmed safe.1 A Kojima spokesperson told Reuters the threatening message was written in English.4
The report does not name the device, the vulnerability, the subsidiary or the outside company. Later accounts rewrote the entry point: Bloomberg in April 2023 wrote that hackers penetrated the systems of "a third-party business partner."8 Kojima's version, its own subsidiary's device used with one outside company, is the one on the record.
Who was behind the Toyota supplier attack? Was it Russia or Emotet?
No one has been named. No government has attributed the attack, no group is named in any Kojima or Toyota document, and a search of a public ransomware leak-site tracker for Kojima on 28 September 2026 found no claim.1,6
The question of Russia was put to the prime minister on 28 February 2022. As Reuters quoted him:9
"It is difficult to say whether this has anything to do with Russia before making thorough checks."
The Emotet link comes from the season, not the sample. Reuters noted on 1 March 2022 that Japan's computer emergency response team had seen increased reports of Emotet since early February.4 Kojima named no malware family; its word is ransomware.1 That is adjacency, not attribution.
Was Toyota's 2023 plant shutdown the same incident?
No. Toyota had two separate stoppage stories in 2023, and neither was this attack.
On 29 August 2023 all 14 plants stopped again after Toyota's production order system failed on 28 August.13,14 On 6 September 2023 Toyota said that during maintenance "an error occurred due to insufficient disk space" and that "the system malfunction was not caused by a cyberattack."14
In July 2023, after the cyberattack on the Port of Nagoya, Toyota paused export-parts packaging the day after the port resumed cargo operations, and said domestic production of finished cars would not be affected, according to Reuters.15 The Port of Nagoya incident has its own entry.
What is still not known about Toyota
Which remote connection device was used, what its vulnerability was, and which Kojima subsidiary and outside company it served.1
Who the attacker was. No government, Kojima document or claim on the record names one.1,6
Which ransomware family was used. Kojima's report names none.1
How many vehicles the day cost. The 13,000 figure is press; Toyota's releases give no count.4,5
What the incident cost Toyota or Kojima.
How long Kojima ran its deliveries by hand.
Whether any data was taken. Kojima's first report found no sign of it; no later report was found.1
Whether Toyota's own systems were untouched. That is reported by the press, not documented by Toyota.7
Claims about Toyota the record does not support
Widely repeated claim
What the record says
"Hackers penetrated the systems of a third-party business partner."
Kojima's own report places the entry at a remote connection device its own subsidiary used for dedicated communication with one outside company.1,8
"Suspected to be a 3rd-party network compromise that laterally moved into Toyota's network."
No record says so. Toyota named only a system failure at a supplier, and no record mentions a Toyota system, robot, PLC or controller.1,3,16
"Unknown Malware (likely Emotet variant)"
Kojima says ransomware and names no family. Reuters reported increased Emotet activity in Japan that month: the season, not the sample.1,4,16
"Likely Spear Phishing or unpatched vulnerabilities through a third-party network"
Kojima's report names a vulnerability in a remote connection device used by its own subsidiary; no record mentions phishing.1,16
"forced the shutdown of 14 Toyota factories and 28 production lines on February 28, 2022"
Toyota announced on 28 February; the plants stopped on 1 March, both shifts, and resumed from the first shift on 2 March.3,5,17
Bloomberg's own "rough calculation of its sales and output data," not a Toyota figure and not a disclosed cost.8
Including our own. Our Volume 1 Hackopedia page said the compromise was suspected to have moved laterally into Toyota's network, gave the vector as "Likely Spear Phishing or unpatched vulnerabilities through a third-party network," called the malware a likely Emotet variant, put losses at about $20M, and wrote its prevention analysis around robot controllers and assembly line PLCs.16 Our 2025 blog dated the shutdown to 28 February, said investigations suggest the attackers first breached a third-party partner network, and said the attack coincided with a surge in Emotet activity; its figure of roughly 25,000 assembly-line workers was not traced to any source.17 None of these is supported by the records read for this entry, and this page replaces them. We correct our own record first; it is what earns the right to correct anyone else's.
Did Toyota disclose the attack to investors?
Not by name. In the Toyota filings read, the day survives only as a change of tense. Toyota's annual report on Form 20-F filed in June 2021 said, in its cyber risk factor, "Toyota may be the subject of such attacks."18 The one filed on 23 June 2022 says "Toyota has been and expects to continue to be the subject of such attacks," and adds a new sentence:12
"Moreover, similar attacks on Toyota's suppliers and business partners have had, and may in the future have, a similar negative impact on Toyota."
The filing names no supplier and no date, and a full-text search of Toyota's SEC filings from February 2022 to December 2023 returns no hit for "Kojima."12 That the new sentence refers to Kojima is BlastWave's reading, not something the filing says. Toyota's Japanese securities report was not read for this entry, so the claim is limited to the filings read.
BlastWave analysis: just-in-time was not the mistake
Analysis, not a disclosed fact
This is an IT compromise that halted physical operations, at one remove. Nothing on the record reached a Toyota system, line, robot or controller. Fourteen plants stopped because the parts, and the information that summons them, stopped. Just-in-time is not the flaw. It is why the system is efficient, and it means the buffer is measured in hours. Both companies acted well: Kojima cut its connections, did not contact the attacker and restored systems as each was confirmed safe, and Toyota restarted the next morning over a backup network to the supplier, a second path that existed before it was needed.1,4
The path is the other half. A door built for one relationship, a subsidiary's link to one outside company, opened onto a supplier whose systems fed fourteen assembly plants.1 Nobody in that chain had to be careless for this to happen; they only had to be connected the way supply chains are now connected. That is BlastWave's analysis, not a disclosed fact.
Podcast: “The Second Baton” (9:06). Joe Baxter and Cam Cullen on why just-in-time was not the mistake, and why a second path for the orders kept it to one day.
Video: Toyota Short (60 to 90 seconds).
Frequently asked questions
What happened in the Toyota cyberattack in 2022?
On 28 February 2022 Toyota announced that, due to a system failure at its domestic supplier Kojima Industries, it would suspend all 28 lines at its 14 plants in Japan on 1 March, both shifts. Production resumed on 2 March. Kojima had been hit by ransomware on the evening of 26 February. Kojima's own report says the attacker entered through a subsidiary's vulnerable remote connection device. No record says a Toyota system was hacked.
Was Toyota itself hacked?
No record says so. Toyota's releases of 28 February and 1 March 2022 name only a system failure at a supplier, Kojima Industries, and do not mention a cyberattack. The Yomiuri newspaper reported no abnormality in Toyota's own systems, but that is a press report, not a Toyota statement. No record mentions a Toyota robot, controller or line being reached.
How did hackers get into Kojima Industries?
Kojima Industries' investigation report of 31 March 2022 says a remote connection device that one of its subsidiaries used for dedicated communication with a specific outside company had a vulnerability. The attacker entered the subsidiary's network through it, then Kojima's own network. The report does not name the device, the flaw, the subsidiary or the outside company. Later press described it as a third-party business partner, which is not Kojima's wording.
Who was behind the attack on Toyota's supplier?
No one has been named. No government has attributed the attack, and neither Kojima nor Toyota names a group. Asked about Russia on 28 February 2022, the prime minister said, as Reuters quoted him, that it was difficult to say whether it had anything to do with Russia before thorough checks. A leak-site tracker search for Kojima in September 2026 found no claim.
Was Emotet used in the Toyota supplier attack?
No record says so. Kojima Industries said ransomware encrypted part of its servers and PCs and named no malware family. The Emotet link comes from timing: Reuters reported on 1 March 2022 that Japan's computer emergency response team had seen more Emotet reports since early February. That is adjacency, not attribution, and BlastWave's own earlier pages repeated it in error.
How much did the Toyota shutdown cost?
The cost is undisclosed. Neither Toyota nor Kojima Industries published a figure. Reuters and Nikkei reported that the one-day suspension hit output of around 13,000 vehicles, but Toyota's releases give no count. Bloomberg's figure of about $375 million, published in April 2023, is its own rough calculation from sales and output data, not a Toyota figure or a disclosed cost.
Did Toyota pay a ransom?
No record says a ransom was paid or demanded for a specific sum. Kojima Industries' report of 31 March 2022 says the threatening message stated no specific ransom amount and that Kojima did not contact the attacker. Kojima cut its network off from customers and the outside, brought in outside security experts, consulted the police and restored systems as each was confirmed safe.
Was the August 2023 Toyota shutdown a cyberattack?
No. On 29 August 2023 all 14 of Toyota's plants in Japan stopped after its production order system failed. On 6 September 2023 Toyota said an error occurred due to insufficient disk space during maintenance and that the malfunction was not caused by a cyberattack. It is a separate event from the Kojima Industries attack of February 2022.
Primary sources are Toyota's own releases, publication and SEC filings, and Kojima Industries' own notices and investigation report. Japanese quotations are BlastWave's translations. Press is cited only as evidence of what was said.
CompanyKojima Industries Corporation, system stoppage investigation report, first report (システム停止事案調査報告書（第1報）), 31 March 2022. Japanese; quotations are BlastWave's translations.
CompanyKojima Industries Corporation (小島プレス工業), notice of a system stoppage caused by virus infection (ウィルス感染被害によるシステム停止事案発生のお知らせ), 1 March 2022. Japanese; quotations are BlastWave's translations.
CompanyToyota Motor Corporation, "March Production Plan (as of February 28)," Global Newsroom, 28 February 2022. global.toyota
PressReuters, "Toyota to restart Japan production after halt caused by cyberattack on supplier," 1 March 2022, as republished by Malay Mail. Cited as evidence of what was said. malaymail.com
CompanyToyota Motor Corporation, "Resumption of Operations at Domestic Plants from March 2 (Wed.)," Global Newsroom, 1 March 2022. global.toyota
Researcherransomware.live, public tracker of ransomware leak-site claims, search for "Kojima" (no victims found), read 28 September 2026. ransomware.live
Presspiyolog, "サプライヤーのシステム障害によるトヨタ自動車の国内全工場停止についてまとめてみた" (a compilation of reporting on the stoppage of all Toyota's domestic plants), 28 February 2022 and updates, compiling Nikkei and Yomiuri reports. Cited as evidence of what was said.
PressBloomberg (Tarabay, Lee, Hyuga), feature on cyberattacks in Japan, 17 April 2023; text read in its Yahoo Finance republication. Cited as evidence of what was said. bloomberg.com
PressNewsweek, report on Toyota's suspension of production in Japan, 28 February 2022, quoting the prime minister "according to Reuters" (NPR carried the same Reuters quotation the same day). Cited as evidence of what was said.
CompanyToyota Times (Toyota's own publication), "Deepening Ties in Difficult Times: 1 Year on from Kojima Industries Cyberattack," 8 March 2023. toyotatimes.jp
CompanyKojima Industries Corporation, notice that its website and mail server were restored (ホームページならびにメールサーバ復旧のお知らせ), 22 March 2022.
Company filingToyota Motor Corporation, Annual Report on Form 20-F for the fiscal year ended 31 March 2022, filed 23 June 2022 (accession 0001193125-22-179197), Risk Factors. EDGAR full-text search of Toyota's filings, 1 February 2022 to 31 December 2023, returns no hit for "Kojima". sec.gov
CompanyToyota Motor Corporation, "Scheduled Resumption of Operations at Domestic Plants," Global Newsroom, 29 August 2023.
CompanyToyota Motor Corporation, "Concerning the production order system malfunction," Global Newsroom, 6 September 2023. global.toyota
PressReuters, on Toyota suspending export-parts packaging after the Port of Nagoya cyberattack, 6 July 2023, as republished. Cited as evidence of what was said.
CompanyBlastWave, Hackopedia Volume 1, "Toyota Motors Manufacturing Plant Attack (2022)." Cited as evidence of our own errors. hackopedia.blastwave.com
CompanyBlastWave blog, Cam Cullen, "How a Supplier Ransomware Attack Shut Down Toyota's Just-in-Time Manufacturing," 4 June 2025. Cited as evidence of our own errors. blastwave.com
Company filingToyota Motor Corporation, Annual Report on Form 20-F for the fiscal year ended 31 March 2021, filed with the US Securities and Exchange Commission 24 June 2021, Risk Factors. sec.gov
Cite this page
BlastWave. “Toyota Plant Shutdown After Kojima Industries Ransomware Attack (2022): What Is Verified.” Hackopedia, Volume 2, FILE 013. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/toyota-2022/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 013 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check: searched a public ransomware leak-site tracker for any claim against Kojima Industries and found none; aligned the account of Toyota's July 2023 packaging pause with the Port of Nagoya entry.
26 Sep 2026
Full validation: re-read our Volume 1 page and 2025 blog so their errors are recorded word for word; dated the August 2023 stoppage to 29 August from Toyota's own release; cited Bloomberg to its dated April 2023 feature.
25 Sep 2026
Second verification pass: Toyota's English and Japanese releases, Kojima Industries' notice of 1 March and investigation report of 31 March 2022, and Toyota's SEC risk-factor sentences re-read at source; confirmed that no Toyota release gives a vehicle count.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected our Volume 1 claims of lateral movement into Toyota, spear phishing, an Emotet variant and a $20M cost, and the 28 February shutdown date in our 2025 blog.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
