Askul Corporation Hit by RansomHouse Ransomware Attack, 740,000 Records Stolen Japanese e-commerce giant Askul Corporation, a subsidiary of Yahoo! Japan specializing in B2B and B2C office supplies and logistics, confirmed that the RansomHouse hacking group stole approximately 740,000 customer records in a ransomware attack in October. The breach forced the company to suspend shipments, disrupting operations for major clients, including retail chain Muji. The compromised data includes: - 590,000 business customer records - 132,000 individual customer records - 15,000 business partner records (outsourcers, agents, suppliers) - 2,700 executive and employee records (including group companies) Askul has withheld specific details to prevent further exploitation but will notify affected parties individually. The company also reported the incident to Japan’s Personal Information Protection Commission and implemented long-term monitoring to track potential misuse of the stolen data. As of December 15, order fulfillment remains disrupted, with full system restoration still underway. ### Attack Details RansomHouse claimed responsibility for the breach, first disclosing it on October 30 and releasing stolen data in two subsequent leaks on November 10 and December 2. Askul’s investigation revealed that attackers exploited compromised credentials from an outsourced partner’s administrator account, which lacked multi-factor authentication (MFA). Once inside, the threat actors: - Conducted network reconnaissance - Disabled EDR (Endpoint Detection and Response) and other security tools - Moved laterally across servers to escalate privileges - Deployed multiple ransomware variants, some evading updated EDR signatures - Encrypted systems and wiped backup files to hinder recovery Askul responded by physically disconnecting infected networks, isolating affected devices, resetting all administrator passwords, and enforcing MFA across critical systems. The financial impact remains uncalculated, prompting a delay in the company’s scheduled earnings report.