Changes to our operations regarding password protected .zip files sent as an attachment followed by a separate email containing the password (PPAP)

Effective January 26, 2022, IIJ will adopt the following change in the basic rules that IIJ uses to handle emails sent from outside the company with regard to the information security measure known as "PPAP," a method in which separate emails are used when sending a password protected file as an attachment and the password for that file using separate emails.

By January 25, 2022	Password protected .zip files will be accepted as email attachments as currently done
From January 26 onward	Password protected .zip files will be deleted and only the email body will be accepted

We will also be changing the procedure for password protected attachment files sent from IIJ to someone outside the company

In light of this change, IIJ will provide a separate method for sharing files and transition to that method. We will be getting in touch with our customers and partners individually regarding how to use that method.

Background behind this change

The PPAP method (which consists of using password protection on files attached to email and sending the password in a separate email) is one of the information security measures that is commonly used in Japan, but in addition to lacking effectiveness, the U.S. Cybersecurity and Infrastructure Security Agency has recommended blocking such attachments because they are often able to slip past virus scans.
Given the potential for this method to be misused to spread malware, IIJ has come to believe that it is necessary to address this concern in order to protect not only our own data, but also that of our customers and partners.

We would like to thank all our customers and partners for your understanding and cooperation on this.