Askul Ransomware Attack Disrupts Muji, Loft and Other Online Retailers in Japan

October 19 attack interrupts shopping and deliveries

A ransomware attack detected at Askul on October 19 has interrupted online shopping across several major Japanese retailers, showing how a failure at one logistics provider can stop orders for multiple brands. As of October 22, Muji owner Ryohin Keikaku, household goods chain Loft and department store group Sogo and Seibu had suspended online sales or shipments connected to Askul's systems.

Askul halted order intake and shipping after the infection caused a system failure. Its office supplies stores, Lohaco marketplace for consumers and Soloel Arena service for corporate customers were affected. The disruption also reached functions that shoppers and businesses use after making a purchase, including tracking packages and accessing account services.

Physical stores continued to operate. Ryohin Keikaku said its own systems had not been compromised, and deliveries and logistics serving Muji's physical shops remained normal. Its Japanese online store and parts of its mobile app were nevertheless affected because they depend on services connected to Askul.

Askul was investigating the extent of the breach, including whether personal or corporate customer data had been accessed. It had confirmed no data leak and given no date for full service restoration. No ransomware group had publicly claimed responsibility, and the companies had not disclosed whether they had received a ransom demand.

The immediate consequences were practical: customers could not complete purchases, some orders were canceled, and retailers could not promise shipping dates. Businesses buying routine office and facility supplies also lost access to a provider serving a large base of individual and corporate customers. The interruption came as Japan approached a busy shopping period, adding pressure to retailers planning promotions and inventory.

What Askul shut down

Askul suspended all new orders and user registrations after reporting the ransomware infection on October 19. Orders that had not yet shipped around the outage window were canceled. The company also paused returns processing, receipt mailing, catalog requests and pharmaceutical orders.

Customer support was affected alongside sales. Askul's help desk and online inquiry forms were unavailable at times, while its corporate website was also inaccessible during parts of the incident. Customers seeking answers about canceled purchases could therefore encounter difficulties reaching the company as well as using its stores.

Askul apologized to customers and business partners. It said investigation and careful recovery work were necessary before services could be restored. Taking systems offline is a common emergency response to ransomware: it can help contain an infection, prevent it from spreading and protect information while investigators determine which systems and data were reached.

The three affected platforms serve different groups. Askul's web stores supply offices, Lohaco serves consumers, and Soloel Arena serves corporate clients. All feed into a nationwide logistics network connecting online storefronts with distribution centers, shipping label printers and carriers that complete the final delivery to customers.

That connection explains why the interruption extended beyond a website error. When central order and warehouse systems become unavailable, workers cannot carry out the normal sequence of receiving orders, locating goods, packing them and arranging shipment. A shopper may see an unavailable product page, while the underlying problem also prevents the warehouse from sending a parcel.

Muji, Loft and Sogo and Seibu face different limits

Muji's Japanese online store went offline following the Askul breach. Some mobile app functions were disabled, product pages could fail to load, and subscription services were paused. Ryohin Keikaku was reviewing which purchases had been affected and said customers with affected orders placed before the suspension would receive email notifications.

Muji's physical shops and deliveries for purchases made in stores continued normally. Customers therefore faced different conditions depending on how they shopped: visiting a store remained possible, while ordering through the domestic website or using some app features was restricted.

Loft suspended its online operations and had not announced a resumption date. Sogo and Seibu halted online sales of selected products linked to Askul's logistics systems. Across the affected services, shoppers encountered error messages, stalled shopping carts and unavailable product pages.

The limits varied by retailer and product, but the customer consequences were similar. New purchases could be blocked, and orders awaiting shipment could face delays or cancellation. Retailers continued to handle transactions in physical stores, while customers using the affected online services lost the ability to shop and receive goods through their usual channels.

The dates behind the disruption

The Askul incident followed another major interruption in Japan's consumer sector less than a month earlier. The dates show how closely the two events occurred, while Askul's next scheduled financial update was approaching.

• Late September 2025: A cyber incident at Asahi Group disrupted beer production. The incident was later linked to a criminal group.
• October 19, 2025: Askul detected a ransomware infection that caused system failures and prompted it to suspend order intake and shipments.
• The first trading day after the incident: Askul shares fell as much as 6 percent, while Ryohin Keikaku shares declined as much as 6.6 percent.
• October 22, 2025: Askul and affected retailers were still assessing the disruption, with no date announced for full restoration.
• October 28, 2025: Askul's monthly earnings data was scheduled for release, although the company said publication might be postponed.

For customers and business buyers, the missing recovery date made planning difficult. A purchase needed urgently could require a visit to a physical store or an order from another retailer, while a business awaiting supplies had to account for uncertainty over delivery.

Why one provider can interrupt several brands

Retailers often outsource order management, payments and fulfillment to specialist providers. Fulfillment means the work of taking an order, finding the product in a warehouse, packing it and getting it to the customer. Outsourcing can lower costs, speed up delivery and give retailers access to infrastructure across the country.

Askul's role connects order intake, warehouse operations and carriers handling the final stage of delivery. Several brands can therefore depend on the same underlying services even when their websites look separate. If a central service stops working, multiple retailers can lose access to essential operations at once.

Modern warehouses rely on closely connected inventory databases, label printers and tools used to book carrier collections. Those connections normally help staff work quickly and accurately. During an outage, however, a warehouse may be unable to turn an online purchase into a correctly labeled parcel with a confirmed delivery arrangement.

Manual work can offer limited relief, but it is difficult to replace all of those connected steps at scale. Backlogs can build quickly when orders and shipments stop. Retailers also face disruption to promotions and inventory plans built around steady online demand.

Corporate buyers face a related problem. Askul supplies offices and facilities, so an interruption can affect routine operations in both small businesses and large enterprises. The impact reaches beyond discretionary shopping to the supplies organisations use in their daily work.

What is known about customer data

Askul was checking whether personal or corporate customer information had been accessed. The investigation covered the possibility of data exposure as well as the systems failure. Cyber incidents can involve stolen login details or the exposure of addresses, telephone numbers and order histories.

Criminal groups sometimes wait before publishing details of an attack or samples of stolen information. The public picture can therefore change as an investigation progresses. Customers should use updates from Askul and the affected retailers for instructions about account security, affected purchases and the return of services.

Unexpected emails or messages asking for passwords, payment details or account information deserve particular caution during a service interruption. Customers may be waiting for a genuine notice about a canceled order, making it especially useful to check requests through official websites and apps.

People who reuse the same password across several services should change it, starting with their most sensitive accounts. Password reuse means that a login stolen from one service can be tried elsewhere. Monitoring bank and card statements for unusual activity is another practical precaution while customers follow company updates.

Shares fall as companies assess the cost

Askul shares fell as much as 6 percent on the first trading day after the attack. Ryohin Keikaku shares declined as much as 6.6 percent. Both companies faced uncertainty over the length of the disruption and the sales that could be lost while services were unavailable.

Askul was evaluating the financial impact and said it might postpone the monthly earnings data scheduled for October 28. An extended interruption could deepen the effect on its results if customers move purchases to other suppliers while its services remain constrained.

Ryohin Keikaku has less exposure to online sales than some peers. Continued trading in Muji's physical stores could limit the effect on earnings if those shops remain busy, although the company still faced disruption to its domestic online business.

Lost sales are only one possible cost of a ransomware incident. Companies also pay for incident response, technical investigations, rebuilding systems and customer support measures such as refunds or credits. Contractual penalties and advertising spending tied to unavailable websites can add further costs.

The wider retail sector watches extended outages because they can alter consumer purchasing and marketing plans for the quarter. A retailer may have stock and a promotion ready, yet be unable to take an order or arrange delivery through the service on which the campaign depends.

How ransomware stops a logistics network

Ransomware typically encrypts files and servers, making them unreadable without the means to unlock them. Intruders can first enter through stolen credentials, vulnerable software or phishing messages designed to trick someone into revealing information or opening a harmful file.

Attackers may then seek administrator access, move between systems and interfere with backups. Administrator access gives broad control over computers and services, allowing damage to reach beyond the first account or device that was compromised.

In logistics, affected systems can include order management, warehouse management, label printing, routing and the software that exchanges information with carriers. If those services are unavailable, accepting a purchase or shipping a parcel can become impossible.

Call center software can also be affected if it depends on the same network or login infrastructure. That helps explain why customers may encounter a sales outage and a support outage together, even though the two services appear to perform different jobs.

Recovery requires more than loading a backup. Technical teams must remove malicious software, rebuild or reinstall servers, reset credentials and check that information remains intact. Services then need to return in stages, with tests at each step and checks that partners can exchange information correctly again.

Other Japanese companies have faced disruption

Asahi Group's late September cyber incident interrupted production lines, delayed product launches and led the brewer to postpone financial reporting while systems were restored. The attack was later linked to a criminal group. Its disruption to beer production preceded Askul's interruption to online shopping and deliveries.

A major parcel carrier also reported unauthorized access to some customer accounts in recent weeks. Those logins were traced to compromised credentials and password reuse, while the carrier's core business systems were unaffected. The case shows another route through which criminals can reach customers in the logistics sector.

Japan also experienced a damaging ransomware incident at a large publishing company in 2024, with effects that spilled into the public domain. Together, the incidents show the exposure of businesses whose work combines valuable information with operations that depend on keeping goods and services moving on time.

Criminal groups target that combination of data and urgency. A company needs time to investigate and recover carefully, while each day of interruption creates economic pressure. Preparing containment plans, practicing restoration from backups and arranging ways to continue limited operations are responses to that pressure.

What retailers and customers can do

Retailers can reduce dependence on a single provider by using more than one fulfillment partner for critical business lines. Separating the systems that accept orders from warehouse systems can also provide more room to respond when one part fails. Limited offline procedures may help with urgent purchases.

Reviews of logistics and technology partners should examine how they store information, separate internal networks and protect remote access tools that attackers often abuse. Retailers and providers can practice incident response together so each side knows its responsibilities during an interruption.

Backups stored offline and tested regularly give businesses a point from which to restore systems without bringing malicious software back with them. Restoring connections with suppliers, retailers and carriers still requires checks that information is accurate and moving correctly.

Customers with orders placed near the outage should retain order numbers and payment confirmations and watch for company emails about cancellations and refunds. For essential purchases, physical shops or alternative retailers may offer a way to obtain goods while affected online services remain unavailable.

Any password reset instructions or credit monitoring offered by Askul or retailers following a data exposure should be followed through official channels. Customers can also review app permissions and install the latest app versions once services resume. Features may return at different times as recovery proceeds in stages.

Key Points

• Askul detected ransomware on October 19 and suspended online order intake and shipments across its office supplies stores, Lohaco and Soloel Arena.
• Muji, Loft and Sogo and Seibu halted affected online services or sales, while physical stores continued operating.
• Ryohin Keikaku said its own systems were not compromised, and Muji's store logistics and deliveries for purchases made in stores continued normally.
• Askul was investigating possible access to personal or corporate customer data. No data leak had been confirmed as of October 22.
• No ransomware group had publicly claimed responsibility, and no full recovery date had been announced.
• Askul shares fell as much as 6 percent and Ryohin Keikaku shares as much as 6.6 percent on the first trading day after the incident.
• Askul said its monthly earnings data, scheduled for October 28, might be delayed.
• The outage followed the late September cyberattack at Asahi Group and other security incidents affecting Japanese logistics and publishing businesses.