Loading story…
Japanese e-commerce company Askul Corporation suffered a ransomware attack attributed to the RansomHouse group, resulting in the theft of approximately 740,000 customer, business partner, and employee records. The breach, discovered in October, led to significant IT system failures, disrupting shipments to customers including major retailers. Askul confirmed that the attackers exploited compromised credentials for an outsourced partner’s administrator account, which lacked multi-factor authentication, to gain initial access. The company has notified affected individuals and Japan’s Personal Information Protection Commission, and is implementing long-term monitoring to prevent misuse of the stolen data.
The stolen data includes around 590,000 records from business customers, 132,000 from individual customers, 15,000 from business partners, and 2,700 from executives and employees. Askul stated that no credit card information was confirmed to be leaked and that no ransom was paid. The RansomHouse group publicly claimed responsibility, adding Askul to its leak site and releasing data in multiple stages. As of mid-December, Askul’s order shipping operations remain impacted while system restoration efforts continue.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Following its disclosure, Askul said it notified affected individuals and organizations and reported the incident to the Personal Information Protection Commission. The company also said it was implementing stronger security controls, long-term monitoring, and business continuity improvements.
Askul stated that Lohaco's payment system was not affected because it does not store credit card information, and that no individual customers' credit card data was leaked. The company also said it had not paid a ransom to the attackers.
By mid-December 2025, Askul disclosed that approximately 740,000 data sets were compromised, including about 590,000 tied to its corporate office supplies service and around 130,000 linked to its Lohaco consumer e-commerce service. The exposed data affected customers, corporate clients, employees, partners, and executives.
In November 2025, RansomHouse added Askul to its dark web leak site and began publishing evidence packs, with additional leaked material released in December. The group claimed to have stolen about 1 TB of sensitive data after failed negotiations or non-payment.
The October attack caused major IT and logistics failures at Askul, including disruption to automated logistics and order systems and shipment delays affecting customers such as Muji. Askul's systems remained under restoration afterward, with some shipping delays and financial reporting impacts continuing into December.
On 2025-10-19, attackers attributed to RansomHouse accessed Askul's environment through an outsourced partner's administrator account that lacked multi-factor authentication. They conducted reconnaissance, harvested additional credentials, disabled security tools, deleted backups, and deployed ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcebleepingcomputer.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Askul, a major Japanese office and household goods retailer, suffered a ransomware attack that severely disrupted its e-commerce and logistics operations. The cyberattack, discovered over a weekend, led Askul to halt all online orders, product shipments, and new user registrations across its three main e-commerce platforms: Askul (office supplies), Lohaco (household goods), and Soloel Arena (corporate clients). The company also suspended customer inquiries due to the system failures caused by the attack. Askul publicly stated that it is investigating the full extent of the incident, including the potential leak of personal and customer data, and has not yet determined when operations will resume. The impact of the attack extended beyond Askul itself, affecting several major Japanese retailers that rely on its logistics network. Muji, a prominent retailer of minimalist household goods and clothing, was forced to take its Japanese online store offline, suspending browsing, purchases, and access to order histories via its app. Muji clarified that only its Japanese online operations were affected, with physical stores and international branches remaining operational. The company is working to identify which customer shipments were impacted and plans to notify affected customers by email. Other retailers, such as Loft and Sogo & Seibu, also reported disruptions, halting online orders and some product shipments due to their reliance on Askul’s logistics systems. Askul’s customer service desk became unreachable, both by phone and online, further complicating the response for affected customers. The attack highlights the interconnectedness of Japan’s retail and logistics sectors, where a single supplier’s outage can cascade across multiple brands and services. The incident follows a series of recent ransomware and cyberattacks targeting Japanese companies, including a notable attack on Asahi, Japan’s largest brewer, earlier in the month. Askul is owned by Yahoo! Japan Corporation and plays a significant role in both business-to-business and business-to-consumer logistics in the country. The company has not disclosed the specific ransomware group responsible, nor the method of initial compromise. Restoration efforts are ongoing, but no timeline for full recovery has been provided. The disruption underscores the vulnerability of supply chain and logistics providers to ransomware attacks and the broad operational impact such incidents can have on dependent businesses. Both Askul and its partners are working to restore services, but the resumption date remains undetermined. The incident has prompted increased scrutiny of cybersecurity practices within Japan’s retail and logistics sectors.
Jun 29, 2026
Asahi Group Holdings, Japan's largest brewing company, suffered a significant ransomware attack in September that disrupted its Japanese operations and led to the exposure of personal data belonging to nearly 2 million individuals. The Qilin ransomware group claimed responsibility, stating it had stolen 27 GB of internal files, including employee records, contracts, and financial documents. The breach affected 1.525 million customer service contacts, 114,000 external contacts, 107,000 current or former employees, and 168,000 family members, with exposed data including names, addresses, phone numbers, email addresses, and in some cases, dates of birth and gender. Credit card information was reportedly not compromised. The attack forced Asahi to suspend order processing, shipments, and customer service operations in Japan, though international branches were not impacted. The attackers gained access via compromised network equipment at a Japanese datacenter, deploying ransomware that encrypted data on multiple servers and connected PCs. Asahi responded by isolating the datacenter within hours and has since pledged to notify all affected individuals. While some stolen data was found online, the company continues to investigate the full scope of the breach. The incident highlights the operational and reputational risks posed by ransomware attacks, especially when large volumes of sensitive personal data are involved.
Jun 29, 2026
Asahi Group Holdings, a major Japanese brewery, suffered a significant cyberattack at the end of September, which has now been attributed to the Qilin ransomware group. The attack initially caused widespread system failures, forcing Asahi to shut down its ordering, shipping, and call center operations across Japan. Early statements from the company assured stakeholders that customer and employee data remained secure, but subsequent investigations revealed traces of unauthorized data transfers. Asahi has since acknowledged the possibility that personal information may have been compromised during the incident. The Qilin ransomware group has claimed responsibility for the attack, boasting of exfiltrating approximately 27 GB of sensitive files. These files reportedly include financial records, contracts, employee details, forecasts, and other confidential documents. Samples of the stolen data, reviewed by journalists, appear to confirm the theft of personal information, such as employee ID cards and personal documents. The breach has had a tangible impact on Asahi's domestic logistics, resulting in delayed shipments and looming stock shortages throughout Japan. Production at all breweries has resumed, but IT systems remain impaired, forcing staff to revert to manual processes like pen, paper, and fax machines for order processing. The company has postponed its quarterly financial results announcement due to the ongoing disruption and uncertainty surrounding the full extent of the breach. Asahi is actively investigating the scope of the data compromise and has committed to notifying affected individuals and complying with relevant data protection laws. The incident has raised concerns about the security of corporate and personal data within large manufacturing organizations. The attack highlights the operational risks posed by ransomware groups targeting critical business infrastructure. Asahi's response includes efforts to restore systems and mitigate further damage, though a timeline for full recovery has not been provided. The company has publicly stated its commitment to transparency and regulatory compliance as the investigation continues. The Qilin group’s public disclosure of stolen data samples has intensified scrutiny and pressure on Asahi to address the breach. The incident underscores the growing threat of ransomware to global supply chains and the importance of robust cybersecurity measures in the manufacturing sector. Asahi’s experience serves as a cautionary tale for other organizations regarding the potential consequences of cyberattacks on both business operations and data privacy.
Jul 12, 2026