Loading story…
Nichirei Logistics Group, Japan’s largest refrigerated logistics provider, is restoring operations after a cyberattack disrupted warehouse activity and frozen-food shipments across its nationwide network. The outage affected about 5,000 customers and rippled into downstream retail operations, with KFC Japan temporarily reducing menu items and shortening hours at some restaurants because of ingredient shortages before later resuming normal service.
The extortion group RansomHouse claimed responsibility on its leak site and reportedly posted some Nichirei data online. Nichirei confirmed the breach and said personal information on some affected servers was stolen, with impacted individuals notified, while the company said it brought in an external security firm, implemented additional security measures, and expected warehousing and shipping operations to return to normal within the week.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
On July 22, Nichirei said it had implemented security measures with an external security firm and expected affected warehousing and shipping operations to return to normal within the week. The company was restoring operations following the cyberattack.
KFC Japan had temporarily reduced menus and shortened hours at some restaurants because of ingredient shortages linked to the Nichirei disruption. It later resumed normal operations.
Nichirei said some affected servers contained personal information, and impacted individuals were notified. Another source reports the company confirmed personal data was stolen.
The ransomware and extortion group RansomHouse claimed the attack on its dark web leak site and threatened to publish, or reportedly posted, Nichirei data online. One source describes the group as Russia-linked.
Nichirei Logistics Group suffered a cyberattack that disrupted warehouse activity and frozen-food shipments across its nationwide distribution network in Japan. The outage affected about 5,000 customers and contributed to ingredient shortages at KFC Japan locations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
KFC Japan suspended online ordering and delivery services nationwide after a cyberattack on logistics provider **Nichirei Corp.** disrupted ingredient shipments to restaurants across the country. The unauthorized intrusion reportedly struck Nichirei's systems on July 13, causing logistics failures that began affecting KFC locations the following day and interrupting deliveries of frozen foods and other products. KFC Japan warned that restaurants nationwide could face product shortages, reduced menus, shortened operating hours, and temporary closures as recovery efforts continue. Online orders through the company's app, website, and third-party delivery platforms were halted, and neither KFC Japan nor Nichirei has disclosed a restoration timeline, the specific attack type, or whether any customer or employee data was compromised.
Jul 22, 2026
Keio Corporation confirmed that ransomware compromised servers across its group in the early hours of September 26, disrupting payment, reservation, and customer-service systems at several retail and hospitality businesses. Keio Plaza Hotel Tokyo payment functions may have been affected, while railway operations continued normally because train services operate on a separate system. Keio isolated its network, notified police, and engaged external specialists to investigate the intrusion route, operational impact, and potential access to customer or business-partner information. The company had not confirmed a data leak or identified a responsible ransomware group at the time of reporting.
Oct 1, 2026
Askul, a major Japanese office and household goods retailer, suffered a ransomware attack that severely disrupted its e-commerce and logistics operations. The cyberattack, discovered over a weekend, led Askul to halt all online orders, product shipments, and new user registrations across its three main e-commerce platforms: Askul (office supplies), Lohaco (household goods), and Soloel Arena (corporate clients). The company also suspended customer inquiries due to the system failures caused by the attack. Askul publicly stated that it is investigating the full extent of the incident, including the potential leak of personal and customer data, and has not yet determined when operations will resume. The impact of the attack extended beyond Askul itself, affecting several major Japanese retailers that rely on its logistics network. Muji, a prominent retailer of minimalist household goods and clothing, was forced to take its Japanese online store offline, suspending browsing, purchases, and access to order histories via its app. Muji clarified that only its Japanese online operations were affected, with physical stores and international branches remaining operational. The company is working to identify which customer shipments were impacted and plans to notify affected customers by email. Other retailers, such as Loft and Sogo & Seibu, also reported disruptions, halting online orders and some product shipments due to their reliance on Askul’s logistics systems. Askul’s customer service desk became unreachable, both by phone and online, further complicating the response for affected customers. The attack highlights the interconnectedness of Japan’s retail and logistics sectors, where a single supplier’s outage can cascade across multiple brands and services. The incident follows a series of recent ransomware and cyberattacks targeting Japanese companies, including a notable attack on Asahi, Japan’s largest brewer, earlier in the month. Askul is owned by Yahoo! Japan Corporation and plays a significant role in both business-to-business and business-to-consumer logistics in the country. The company has not disclosed the specific ransomware group responsible, nor the method of initial compromise. Restoration efforts are ongoing, but no timeline for full recovery has been provided. The disruption underscores the vulnerability of supply chain and logistics providers to ransomware attacks and the broad operational impact such incidents can have on dependent businesses. Both Askul and its partners are working to restore services, but the resumption date remains undetermined. The incident has prompted increased scrutiny of cybersecurity practices within Japan’s retail and logistics sectors.
Jun 29, 2026