Japan’s corporate sector is weathering a fresh wave of ransomware attacks, with high-profile disruptions at Asahi Group Holdings and Askul underscoring a broader surge. According to Japan’s National Police Agency, reported ransomware cases in the first half of 2025 rose to roughly 1.4 times the level seen a year earlier, highlighting both the growing boldness of criminal groups and structural weaknesses that make Japanese firms compelling targets. The recent incidents also show how quickly damage travels through supply chains, transforming a single compromise into nationwide consumer and business disruptions.
Two headline cases that rattled daily life
On September 29, Asahi Group Holdings disclosed system outages affecting order and shipment operations as well as call center functions at domestic group companies. The company said it was investigating, including the strong possibility of a ransomware attack. While the probe continues, the impact demonstrated how immediately operational technology and core back-office systems can become choke points when malware takes hold. Less than a month later, on October 19, Askul, a major e-commerce and logistics provider, reported a ransomware infection that crippled its ordering and shipping capabilities. The incident affected services for both corporate and individual customers, including the platforms “ASKUL,” “LOHACO,” and “Soloel Arena.” By October 31, Askul confirmed that data on customers and other parties had been exfiltrated by the attackers. The disruption did not stop at one company: firms that rely on Askul’s logistics networks also faced delays and service limitations, a textbook example of how ransomware can cascade through interconnected systems and partners.
Why Japan is a lucrative and “easy-to-monetize” target
Attackers weigh two core questions when choosing targets: how easy is entry, and how big is the payoff? In Japan, the answer to both often skews in criminals’ favor. Japanese companies sit at pivotal points in manufacturing, logistics, and distribution—if just one node goes down, multiple industries can feel the impact. That increases the pressure on victims to restore operations quickly, often making them appear more likely to acquiesce to ransom demands. Japan’s manufacturing base also conducts complex international transactions, making the potential value of stolen data higher and any resulting disruption more widespread. For attackers, that adds leverage: cutting off a production line can ripple across border-spanning supply chains, exerting intense business pressure on victims within hours.
The supply-chain factor: when partners become pathways
Recent cases show a pronounced trend: ransomware spreading via supply chains. More organizations are seeing their systems compromised after a partner, supplier, or managed service provider is breached. Logistics and e-commerce exemplify this risk. If a logistics firm is hit, retailers can be forced to suspend online sales; if a software vendor is compromised, customers may unknowingly propagate malicious updates across hundreds of endpoints. In a market where business integration is tight and legacy systems are interwoven with modern platforms, the attack surface expands beyond the boundaries of any single company. Even firms that are not the direct target can experience collateral damage through trusted connections, where a single compromised credential or remote access gateway opens doors across multiple organizations.
Remote work, cloud adoption, and the widening attack surface
Broader shifts in work and technology have also expanded the attack surface. The rapid rollout of VPN devices and remote access solutions during the pandemic left misconfigurations that criminals continue to exploit. Cloud adoption, while improving scalability and resilience, increases the volume and movement of data, creating more points where access can be abused if identity and access controls are weak. Meanwhile, the ubiquity of cryptocurrencies has simplified ransom collection and laundering, lowering barriers for cybercriminals to operate at scale.
What Asahi and Askul reveal about underlying vulnerabilities
Viewed together, the Asahi and Askul incidents highlight common root causes behind many Japanese ransomware cases. First is deep digital dependency: mission-critical processes—from order intake and inventory management to factory controls and logistics—are tightly bound to IT systems. If those systems stall, the business stalls. Second is the challenge of constraining intrusions: legacy applications, older operating systems, and sprawling networks make it hard to segment environments and limit contagion. The presence of multiple ingress points—VPN appliances, remote desktop services, and vendor connections—creates numerous paths for lateral movement once attackers get inside. Third is reliance on shared platforms across corporate groups and vendors. When an outsourcer or a logistics partner is compromised, the impact can scale up to the parent company and across ecosystems that depend on a common service layer.
Not a Japan-only problem—but uniquely visible
It would be wrong to conclude that Japan alone is under siege. Ransomware is a global menace, with major incidents regularly striking North America, Europe, and Asia. What made the recent Japanese cases so visible was their consumer-facing impact—beer, beverages, household goods, and everyday e-commerce were interrupted—alongside the reach of supply chains tied to household-name companies. The result is a perception that “Japan is being targeted,” when in reality the news reflects a broader reality of digital interdependence: in an economy where business services and logistics are tightly coupled, any single failure can quickly become a story everyone notices.
From technical patching to board-level risk
Ransomware is not merely a security or IT problem—it is a governance challenge. Decisions about legacy system modernization, architecture, backup strategy, and vendor selection are strategic choices that shape attack resilience. Board and executive oversight is crucial: companies need an up-to-date inventory of critical assets, clear recovery time objectives, and regular exercises to test incident response. Technical fundamentals still matter enormously. Priorities include multi-factor authentication across remote access and administrative accounts; network segmentation and microsegmentation to contain blasts; rigorous patching of VPNs, gateways, and edge devices; endpoint detection and response to spot lateral movement; and offline or immutable backups that are frequently tested for restoration. For supply-chain resilience, firms should raise the bar with third parties—baking security controls and audit rights into contracts, requiring timely patching and MFA, and ensuring that shared platforms support tenant isolation and rapid containment. Tabletop exercises should include partners and critical service providers to clarify roles and escalation paths during a crisis.
Paying the ransom is not a recovery plan
Law enforcement worldwide warns that paying a ransom fuels criminal activity and does not guarantee restoration or data deletion. Each incident is complex, and companies must weigh legal, operational, and ethical considerations—particularly if critical services are at stake. But the best leverage is preparation: maintaining resilient backups, practicing rapid rebuilds, and planning communications with customers, regulators, and suppliers. Transparent, timely disclosure helps reduce speculation and coordinate recovery across the ecosystem.
What comes next
With reported cases up 1.4 times year-on-year in the first half of 2025, Japanese firms should expect continued pressure from ransomware groups that iterate quickly and specialize in exploiting partners and edge devices. The response will require more than after-the-fact fixes. It calls for sustained investment in modernization, consistent security baselines across group companies and vendors, and a culture that treats cybersecurity as a continuous business discipline rather than a compliance checkbox. In a tightly connected economy, resilience is not only a defensive posture—it is a competitive advantage.
