Canon hit by suspected Maze ransomware attack
Two dozen domains and a host of internal services have been knocked offline


Hackers have reportedly targeted Canon’s US-based services with the notorious Maze ransomware, rendering various services offline and compromising 10TB of data.
The alleged cyber attack has affected a number of services, including Canon’s email, Microsoft Teams, its US website and several internal applications, according to Bleeping Computer, with users also unable to access various domains.
The publication obtained a partial screenshot of an alleged ransom note and also liaised with the ransomware operators, who claimed they conducted their attack yesterday, stealing “10 terabytes of data, private databases etc” in the process.
“We are aware that Canon USA are experiencing system issues – an investigation is currently taking place," a spokesperson told IT Pro. "We can confirm however that this is unrelated to the data loss we experienced on image.canon earlier this week.”
UK sites and servies appear to be unaffected by the attack.
The hackers behind Maze have been prolific in recent months, targeting a vast number of enterprises during 2020. Aerospace services provider VT San Antonio Aerospace (VT SAA), for example, was affected in June, while Xerox was among a handful of high-profile victims last month, with the ransomware group stealing more than 100GB files from the legacy printing giant.
This is in addition to the major attack on the IT services provider Cognizant earlier this year, which led to the company announcing it could lose up to $70 million as a direct result.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Canon’s IT department reportedly distributed a message to its employees yesterday morning suggesting its US-based systems were experiencing widespread issues, affecting multiple applications, including emails and use of Microsoft Teams.
Several domains are also out of action at the time of writing, with senior security advisor with Sophos, John Shier, suggesting this could be as many as 24 services. Among these are canonusa.com, canonhelp.com and canonbroadcast.com.
“Following other recent high profile attacks, this latest salvo should be a wake-up call to all enterprises that haven't taken the time to assess their security posture and bolster their defences against these pernicious adversaries,” Shier said.
“Many of these attacks start by exploiting external services or simple phishing campaigns. Successful campaigns will often be followed by living-off-the-land techniques, abusing over-privileged and under-protected accounts, and hiding in plain sight.”
He added that enterprises must take the time to build a strong security foundation which includes multi-factor authentication (MFA) everywhere, regular patching, and user training.

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.
-
LaunchDarkly to "double down" on observability with Highlight acquisition
News Highlight's observability tools will be integrated into LaunchDarkly's Guarded Releases software deployment service
By Daniel Todd
-
Samsung Galaxy Tab S10 FE review
Reviews The Tab S10 FE retains the feel and core capabilities of Samsung's high-end S10 tablets, but compromises on the display and the performance
By Stuart Andrews
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
By Nicole Kobie
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz