ASKUL ransomware attack: a contractor admin account, no MFA

ASKUL CorporationOffice supplies, e-commerce and logisticsJPRansomware

1 Summary

On the morning of October 19, 2025, ASKUL detected a ransomware attack, and ordering and shipping stopped across its business and consumer services. The investigation found the first entry four and a half months earlier, on June 5, through a contractor's administrator account without multi-factor authentication. About 740,000 records were leaked. Web orders resumed on December 3.

Probable cause: An administrator account issued to an outsourcing contractor, exempted from multi-factor authentication as an exception, was used from outside the company with leaked credentials.

Fig. 4-6-1ASKUL, the way in

Source: ASKUL Corporation 「ランサムウェア攻撃の影響調査結果および安全性強化に向けた取り組みのご報告（ランサムウェア攻撃によるシステム障害関連・第 13 報）」 (PDF pp.1–4, 6)

The company says an outsourcing contractor's administrator account was used "from outside the company". It does not name the device the account logged in to.

S=1:100 2 Factual information

2.1 The way in

The company: the ID and password of an administrator account issued to an outsourcing contractor, one to which multi-factor authentication had "exceptionally" not been applied, leaked by some means and were misused for initial entry from outside the company. A vulnerability the VPN appliance vendor published in late September 2025 showed no trace of exploitation.

Product: Not stated
CVE: Not stated

2.2 After entry

From June to early October the intruder tried to gain administrator rights. From July onward EDR and other security software was disabled, the intruder moved through the logistics and internal systems, and ransomware was staged. On October 19 the ransomware launched, encrypting servers and deleting backup files. On October 22 a cloud service account was also compromised and data taken. The attacker published data on October 30, November 10 and December 2.

2.3 Damage

Orders and shipping for ASKUL, Soloel Arena and LOHACO stopped from October 19; the ASKUL and Soloel Arena websites resumed taking orders on December 3. About 740,000 records leaked, covering business customers, consumers, business partners and staff. The company had no contact with the attacker.

2.4 Sequence of events

Time	Actor	Event	Source
2025-06-05	Intruder	Initial entry from outside with a contractor's administrator account.	ASKUL Corporation
2025-10-19	Company	Morning: ransomware attack detected; first press release.	ASKUL Corporation
2025-10-20	Company	Outside specialists engaged; log analysis begins.	ASKUL Corporation
2025-10-22	Intruder	Unauthorized access to an external cloud service.	ASKUL Corporation
2025-10-31	Company	Confirms the data the attacker published on the night of October 30.	ASKUL Corporation
2025-12-03	Company	ASKUL and Soloel Arena websites resume taking orders.	ASKUL Corporation
2025-12-12	Company	Investigation results published (13th report).	ASKUL Corporation

S=1:100 3 Analysis

Point	Finding	Source
Multi-factor authentication had exceptionally not been applied to one contractor's administrator account.	Stated	ASKUL Corporation
The VPN vendor's late-September 2025 vulnerability showed no trace of exploitation.	Stated	ASKUL Corporation
How the contractor's ID and password leaked.	Unknown	ASKUL Corporation

S=1:100 4 Conclusions

The company concluded that the intruder used a contractor's administrator account, exempt from multi-factor authentication, to enter from outside on June 5, and spent four and a half months disabling defenses and staging ransomware before launching it on October 19.

S=1:100 5 Recommendations

Recommended or carried out by: Company

Reset the passwords of all administrator and other key accounts, and apply multi-factor authentication to the main systems.
Apply multi-factor authentication to all remote access, including contractors'.
Run EDR on all servers with round-the-clock monitoring.
Keep backups that ransomware cannot reach.

ASKUL ransomware attack: the way in and the timeline