Loading story…
Japanese companies, including major manufacturers and retailers such as Asahi Holdings and Askul, have experienced prolonged operational disruptions following ransomware attacks. Asahi Holdings continues to face back-office issues and has acknowledged a potential data breach affecting 1.9 million individuals, while Askul only recently resumed partial operations after more than six weeks of downtime, with ongoing shipment delays. These incidents highlight the extended recovery periods for Japanese firms, especially when ransoms are not paid, and the broader impact on supply chains, as seen with Muji's halted sales due to Askul's outage.
Globally, the manufacturing sector has shown some improvement in defending against ransomware, with only 40% of attacks resulting in data encryption compared to 74% the previous year. However, data theft remains a significant risk, with 39% of affected manufacturers suffering data loss, and more than half still paying ransoms despite better defenses. The sector continues to face challenges such as skilled labor shortages, unknown vulnerabilities, and increased stress on IT and security teams, with nearly half reporting heightened pressure and a notable proportion experiencing leadership changes after attacks.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Online retailer Askul experienced a prolonged outage from a ransomware attack that disrupted its own business and also impacted other companies, including Muji. The incident illustrated the downstream operational effects of ransomware on Japanese supply chains.
Following the ransomware incident, Asahi Holdings acknowledged that personal data may have been compromised. The company said the potential breach could affect about 1.9 million people.
Asahi Holdings, a major Japanese food and beverage company, suffered a ransomware attack that disrupted operations. More than two months later, the company was still dealing with back-office system issues, indicating the attack likely occurred around early October 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware continues to pose a significant threat to the manufacturing and logistics industries, with attackers increasingly targeting these sectors due to their critical role in global supply chains. According to Black Kite's 2025 Manufacturing Research Report, manufacturing has been the top target for ransomware groups for four consecutive years, accounting for 22% of all reported attacks between April 2024 and March 2025. This equates to 1,314 attacks out of a total of 6,046, highlighting the persistent focus of cybercriminals on this sector. The report notes that while newer ransomware groups may favor smaller companies, large manufacturing enterprises remain highly attractive targets due to the potential for widespread operational disruption. Attackers are not acting indiscriminately; they deliberately target manufacturing because any interruption can have cascading effects throughout the supply chain. The evolution of ransomware tactics is also notable, with some groups shifting from traditional encryption-based extortion to pure data theft and extortion, and others leveraging artificial intelligence to enhance their attacks. The Dragos Industrial Ransomware Analysis for Q2 2025 corroborates these findings, emphasizing that manufacturing remains the most impacted sector. Companies are responding by strengthening their cybersecurity postures, particularly through improved patch management protocols and increased awareness of the threat landscape. The logistics sector has also been severely affected, as illustrated by the ransomware attack on Kantsu, a midsize Japanese logistics company. On September 12, 2024, Kantsu's internal network and all systems were locked by ransomware, halting shipping operations and cutting off communications both internally and externally. The attack rendered all company data unavailable, impacting over 500 partner companies and threatening the very survival of the business. Kantsu's experience underscores the importance of business resilience and the need for robust incident response plans. The company, which had invested in cloud-based warehouse management systems to streamline operations, found itself grappling with the operational and reputational fallout of the attack. The incident highlights the broader trend of ransomware groups targeting organizations whose operational continuity is vital to the functioning of other businesses. Both manufacturing and logistics companies are increasingly aware that their critical position in supply chains makes them prime targets for cybercriminals. As a result, there is a growing emphasis on proactive defense measures, including timely software updates, employee training, and the adoption of advanced security technologies. The ongoing battle between ransomware actors and these industries is driving innovation in both attack techniques and defensive strategies. The stakes are high, as successful attacks can disrupt not only individual companies but also the broader economy. The need for cross-sector collaboration and information sharing has never been greater, as organizations seek to stay ahead of evolving threats. Ultimately, the fight against ransomware in manufacturing and logistics is an escalating battle, with both sides adapting rapidly to new challenges and opportunities.
Jul 12, 2026
Ransomware attacks have reached unprecedented levels globally, with the third quarter of 2025 witnessing a 36% year-over-year increase in publicly disclosed incidents, according to BlackFog’s latest report. The total number of ransomware attacks reported in this period climbed to 270, marking a 335% rise since Q3 2020. These attacks have caused significant operational disruptions across various sectors, including airlines, automotive manufacturers, governments, and organizations in 93 countries. Notable incidents include grounded aircraft, stranded passengers, and manufacturers such as Jaguar Land Rover being forced to halt production, with some operations only recently resuming after prolonged outages. The impact of ransomware extends beyond large enterprises, severely affecting small businesses that often lack the resources and security infrastructure to defend against such threats. Many small business owners have reported devastating financial consequences, with some losing nearly all their savings and seeing their businesses shrink dramatically. The attack on the UK nursery chain Kido in September 2025 highlighted the evolving tactics of ransomware groups, as sensitive data on children, parents, and carers was exfiltrated, raising concerns about the targeting of vulnerable sectors. Ransomware operators are increasingly indiscriminate, targeting organizations of all sizes and types, and seeking leverage through data theft and extortion. The psychological and financial toll on victims is profound, with individuals and organizations facing long-term recovery challenges. Research indicates that small businesses are particularly vulnerable, often lacking dedicated IT security staff, legal support, or sufficient cash reserves to weather the aftermath of an attack. The stress and adversity experienced by victims underscore the need for robust data protection and incident response strategies. Experts emphasize that the best defense is to make it as difficult as possible for cybercriminals to succeed, focusing on data protection to reduce the incentive for extortion. The continued upward trend in ransomware volumes signals an urgent need for organizations to reassess their security postures and invest in preventive measures. The widespread and lasting impact of these attacks demonstrates that ransomware remains one of the most significant threats to global business continuity and data security. Organizations are urged to prioritize anti-data exfiltration technologies and comprehensive incident response planning. The evolving threat landscape requires constant vigilance and adaptation to new attacker tactics. The experiences of both large enterprises and small businesses illustrate the far-reaching consequences of ransomware, from operational shutdowns to personal financial ruin. As attackers become more aggressive and sophisticated, the imperative for proactive defense and resilience has never been greater.
Jun 29, 2026
Askul, a major Japanese office and household goods retailer, suffered a ransomware attack that severely disrupted its e-commerce and logistics operations. The cyberattack, discovered over a weekend, led Askul to halt all online orders, product shipments, and new user registrations across its three main e-commerce platforms: Askul (office supplies), Lohaco (household goods), and Soloel Arena (corporate clients). The company also suspended customer inquiries due to the system failures caused by the attack. Askul publicly stated that it is investigating the full extent of the incident, including the potential leak of personal and customer data, and has not yet determined when operations will resume. The impact of the attack extended beyond Askul itself, affecting several major Japanese retailers that rely on its logistics network. Muji, a prominent retailer of minimalist household goods and clothing, was forced to take its Japanese online store offline, suspending browsing, purchases, and access to order histories via its app. Muji clarified that only its Japanese online operations were affected, with physical stores and international branches remaining operational. The company is working to identify which customer shipments were impacted and plans to notify affected customers by email. Other retailers, such as Loft and Sogo & Seibu, also reported disruptions, halting online orders and some product shipments due to their reliance on Askul’s logistics systems. Askul’s customer service desk became unreachable, both by phone and online, further complicating the response for affected customers. The attack highlights the interconnectedness of Japan’s retail and logistics sectors, where a single supplier’s outage can cascade across multiple brands and services. The incident follows a series of recent ransomware and cyberattacks targeting Japanese companies, including a notable attack on Asahi, Japan’s largest brewer, earlier in the month. Askul is owned by Yahoo! Japan Corporation and plays a significant role in both business-to-business and business-to-consumer logistics in the country. The company has not disclosed the specific ransomware group responsible, nor the method of initial compromise. Restoration efforts are ongoing, but no timeline for full recovery has been provided. The disruption underscores the vulnerability of supply chain and logistics providers to ransomware attacks and the broad operational impact such incidents can have on dependent businesses. Both Askul and its partners are working to restore services, but the resumption date remains undetermined. The incident has prompted increased scrutiny of cybersecurity practices within Japan’s retail and logistics sectors.
Jun 29, 2026