Askul data breach exposed over 700,000 records after ransomware attack

Askul disclosed that an October ransomware attack by the RansomHouse group compromised over 700,000 records at the Japanese e‑commerce and logistics firm. The breach was detected on October 19, 2025, during which attackers accessed the company’s infrastructure and stole data, causing major disruptions to orders, shipping and automated logistics systems.

Information leaked in November and December, with RansomHouse claiming the theft of 1 TB of data and releasing three evidence packs; Askul also noted that the attack affected customer and partner data. The company’s breach notification records show that about 590,000 business service records, 132,000 consumer records, and thousands of employee and executive records were involved, with executives and employees numbering around 2,700.

Attackers reportedly used stolen credentials to gain initial access, conducted reconnaissance, harvested more credentials, moved laterally, disabled security systems and deployed ransomware after deleting backups. According to Personal Information Protection Commission, affected customers and partners have been notified individually and the firm has implemented long‑term monitoring and additional measures as needed.