Loading story…
KFC Japan suspended online ordering and delivery services nationwide after a cyberattack on logistics provider Nichirei Corp. disrupted ingredient shipments to restaurants across the country. The unauthorized intrusion reportedly struck Nichirei's systems on July 13, causing logistics failures that began affecting KFC locations the following day and interrupting deliveries of frozen foods and other products.
KFC Japan warned that restaurants nationwide could face product shortages, reduced menus, shortened operating hours, and temporary closures as recovery efforts continue. Online orders through the company's app, website, and third-party delivery platforms were halted, and neither KFC Japan nor Nichirei has disclosed a restoration timeline, the specific attack type, or whether any customer or employee data was compromised.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Nichirei said it would start gradually restoring operations affected by the cyberattack beginning Friday. The company did not provide a timeline for full recovery as refrigerated warehouse and shipping operations remained disrupted.
Reporting on July 17, 2026 said Nichirei's cyberattack-related outage was disrupting additional downstream firms, including Ezaki Glico and Kura Sushi. The impacts included delayed ice cream shipments, possible menu changes, and delivery delays, extending the known fallout beyond previously reported retailers and KFC Japan.
NHK reported that Nichirei's system failures were also affecting major retailers and delivery services, including reduced stock at some Aeon and Don Quijote outlets and possible delivery issues for Co-opdeli orders. This expanded the known downstream impact beyond KFC Japan.
Nichirei said some of the servers impacted by the intrusion contained personal information and that it notified Japan's data protection authorities while investigating the incident. The company did not identify the attackers or intrusion method.
Amid the logistics disruption, KFC Japan suspended online ordering through its app, website, and third-party delivery integrations. The company said restoration timing was unclear while the provider worked to recover systems.
Beginning July 14, 2026, the provider's system failure disrupted ingredient deliveries to KFC restaurants across Japan. KFC warned stores could face shortages, reduced menus or hours, and temporary closures.
KFC Japan said a cyberattack struck its third-party logistics provider on July 13, 2026. Teiss identified the provider as Nichirei Corp., which disclosed an unauthorized intrusion affecting its logistics systems and shipments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
10 references tracked. Mallory keeps watching after this page renders.
businessinsurance.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcenichirei.co.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nichirei Logistics Group, Japan’s largest refrigerated logistics provider, is restoring operations after a cyberattack disrupted warehouse activity and frozen-food shipments across its nationwide network. The outage affected about 5,000 customers and rippled into downstream retail operations, with **KFC Japan** temporarily reducing menu items and shortening hours at some restaurants because of ingredient shortages before later resuming normal service. The extortion group **RansomHouse** claimed responsibility on its leak site and reportedly posted some Nichirei data online. Nichirei confirmed the breach and said personal information on some affected servers was stolen, with impacted individuals notified, while the company said it brought in an external security firm, implemented additional security measures, and expected warehousing and shipping operations to return to normal within the week.
Jul 23, 2026
Nihon Kotsu, Japan’s largest taxi operator, said unauthorized external access involving malware compromised parts of its internal environment, forcing the company to disconnect affected systems and suspend several services. The disruption hit taxi dispatch, telephone-based bookings, online hire-car reservations, reservation management, web booking, and some internal systems, leaving customers to rely on the **GO** taxi app, nearby taxi stands, or street hailing while restoration work continues. The company said it has isolated parts of its network and brought in external cybersecurity specialists to investigate the cause, scope, and possible impact of the intrusion. Nihon Kotsu has not confirmed any data leak and said it is still assessing whether customer or partner information was exposed, with notifications to follow if necessary; it also warned customers to be alert for suspicious messages or links impersonating the company.
Jul 20, 2026
Askul, a major Japanese office and household goods retailer, suffered a ransomware attack that severely disrupted its e-commerce and logistics operations. The cyberattack, discovered over a weekend, led Askul to halt all online orders, product shipments, and new user registrations across its three main e-commerce platforms: Askul (office supplies), Lohaco (household goods), and Soloel Arena (corporate clients). The company also suspended customer inquiries due to the system failures caused by the attack. Askul publicly stated that it is investigating the full extent of the incident, including the potential leak of personal and customer data, and has not yet determined when operations will resume. The impact of the attack extended beyond Askul itself, affecting several major Japanese retailers that rely on its logistics network. Muji, a prominent retailer of minimalist household goods and clothing, was forced to take its Japanese online store offline, suspending browsing, purchases, and access to order histories via its app. Muji clarified that only its Japanese online operations were affected, with physical stores and international branches remaining operational. The company is working to identify which customer shipments were impacted and plans to notify affected customers by email. Other retailers, such as Loft and Sogo & Seibu, also reported disruptions, halting online orders and some product shipments due to their reliance on Askul’s logistics systems. Askul’s customer service desk became unreachable, both by phone and online, further complicating the response for affected customers. The attack highlights the interconnectedness of Japan’s retail and logistics sectors, where a single supplier’s outage can cascade across multiple brands and services. The incident follows a series of recent ransomware and cyberattacks targeting Japanese companies, including a notable attack on Asahi, Japan’s largest brewer, earlier in the month. Askul is owned by Yahoo! Japan Corporation and plays a significant role in both business-to-business and business-to-consumer logistics in the country. The company has not disclosed the specific ransomware group responsible, nor the method of initial compromise. Restoration efforts are ongoing, but no timeline for full recovery has been provided. The disruption underscores the vulnerability of supply chain and logistics providers to ransomware attacks and the broad operational impact such incidents can have on dependent businesses. Both Askul and its partners are working to restore services, but the resumption date remains undetermined. The incident has prompted increased scrutiny of cybersecurity practices within Japan’s retail and logistics sectors.
Jun 29, 2026