# RansomHouse Ransomware Attack Disrupts Nichirei Japanese Frozen Food Supply Chain, Cascading to KFC Japan, Aeon, Kura Sushi

> On July 13, 2026, Japan's largest cold-chain logistics operator Nichirei Corporation was hit by a cyberattack that disrupted refrigerated warehouse and shipping operations across its 140 distribution centers, cascading to roughly 5,000 downstream business partners including KFC Japan (1,300+ stores), Aeon supermarkets, Kura Sushi, Hotto Motto, Yayoi Ken, and TableMark. On July 22, 2026 the double-extortion group RansomHouse claimed responsibility on its dark-web leak site, asserting data theft and displaying an evidence pack while alleging Nichirei's IT department was concealing the incident.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1639
- **ID:** TL-2026-1639
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Ransomhouse
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Nichirei Corporation, Japan's largest frozen-food manufacturer and cold-chain logistics provider, experienced a system outage beginning Monday, July 13, 2026, that Nichirei confirmed on July 15-16 was the result of unauthorized access. The company proactively disconnected key systems as a containment measure, withholding technical details of the intrusion (attack vector, malware family, and whether encryption occurred) to "avoid security risks" and prevent further damage. The disruption struck Nichirei Logistics Group's refrigerated warehouse network — approximately 140 temperature-controlled distribution centers serving about 5,000 business partners — halting incoming and outgoing shipments of frozen food products.

The operational fallout cascaded rapidly through Japan's food supply chain. KFC Japan, which outsources chicken and ingredient delivery to Nichirei's logistics subsidiary, warned that all 1,300+ of its nationwide restaurants could be affected, resulting in ingredient shortages, menu limitations, reduced operating hours, and temporary closures at some locations. Aeon supermarkets reported shortages of frozen food items. Kura Sushi reported shipment delays at stores in western Japan. TableMark was unable to ship products to retail and commercial clients. Hotto Motto and Yayoi Ken, both major Japanese fast-casual/bento chains, also experienced delivery delays.

Nichirei acknowledged that some of the affected servers stored personal information and submitted an initial report to Japan's Personal Information Protection Commission (PPC) regarding the possibility of a data leak, stating it would promptly report to relevant parties if leakage were confirmed. The company engaged an external cybersecurity specialist firm to support recovery and began a phased restoration of systems starting Friday, July 17, 2026, with no confirmed date for full recovery given as of July 22.

On July 22, 2026, cybersecurity firm S&J (via its president Nobuo Miwa) confirmed that the double-extortion ransomware/data-extortion group RansomHouse had posted a claim of responsibility on its dark-web leak site, displaying what it represented as stolen internal Nichirei data (including confidential and project documents) and urging the company to make contact to prevent a public leak. RansomHouse's post reportedly listed "Encrypted: July 13, 2026" and a status of "EVIDENCE — It's up to you," consistent with the group's typical 4-6 day negotiation window before public disclosure of stolen data. Nichirei has not verified the authenticity of the leaked evidence pack as of this writing. Commentators have noted RansomHouse also claimed an October 2025 attack on Japanese office-supply e-commerce firm ASKUL (approximately 1.1 TB reportedly exfiltrated), raising the possibility of a pattern of targeting Japanese logistics/e-commerce infrastructure by the same group, though no technical overlap has been publicly confirmed between the two intrusions.

RansomHouse is a double-extortion data-extortion group first observed in December 2021, notable for de-emphasizing encryption in favor of data theft and threatened publication — encryption (via its Babuk-derived "Mario"/"White Rabbit" encryptor branding) is typically only deployed if ransom demands are not met. The group has previously claimed victims including AMD, ADATA, IFX Networks (Colombian government ministries, 2023 supply-chain incident), Christie's auction house, Saskatchewan Liquor and Gaming Authority, and a major U.S. semiconductor company (450GB exfiltrated). RansomHouse has documented ties to Iranian state-sponsored initial access broker Pioneer Kitten (Fox Kitten/UNC757/Lemon Sandstorm), which supplies footholds via exploitation of edge appliances (Citrix, Palo Alto Networks, Check Point). The group's known toolkit includes Mimikatz and ProcDump for credential theft/LSASS dumping, Cobalt Strike and Vatet loader, Advanced IP Scanner and TeamViewer for reconnaissance/remote access, MEGAsync/Rclone for exfiltration, and MrAgent for automated ESXi ransomware deployment. No specific initial access vector, malware sample, or IOC has yet been publicly confirmed for the Nichirei intrusion itself; this record documents the incident using verified public reporting plus RansomHouse's established TTP baseline from prior confirmed intrusions, pending release of forensic detail from Nichirei or its incident-response partner.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1087 Account Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1217 Browser Information Discovery
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1134 Access Token Manipulation
- T1556 Modify Authentication Process
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1020 Automated Exfiltration
- T1567 Exfiltration Over Web Service
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1485 Data Destruction

## Sources

- [Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei](https://www.securityweek.com/cyberattack-disrupts-operations-of-japanese-frozen-food-giant-nichirei/)
- [Hacker group RansomHouse claims responsibility for cyberattack on Nichirei](https://www.japantimes.co.jp/business/2026/07/22/companies/nichirei-cyberattack-ransomhouse/)
- [Cyberattack on Japan's largest cold-chain operator disrupts KFC, supermarket supplies](https://therecord.media/cyberattack-japan-nichirei-logistics-impacts-kfc)
- [Russian hackers claim responsibility for cyberattack on Nichirei](https://www.tokyoreporter.com/japan-news/russian-hackers-claim-responsibility-for-cyberattack-on-nichirei/)
- [Hacker Group Claims to Be Behind Nichirei Cyberattack](https://www.nippon.com/en/news/yjj2026072200270/)
- [RansomHouse Claims Responsibility for Cyberattack on Nichirei](https://newsonjapan.com/article/150067.php)
- [Nichirei System Outage: Ransomware Group "RansomHouse" Claims Responsibility, Possibly Same Group Behind ASKUL Attack](https://finance.biggo.com/news/ad940519-4418-4c7d-a7b4-a7f9e2749323)
- [Chicken Back on Menu as Cyber-Hit Nichirei Restores Operations in Japan](https://www.insurancejournal.com/news/international/2026/07/22/878533.htm)
- [Nichirei getting back online after cyberattack hit KFC supplies](https://www.japantimes.co.jp/business/2026/07/16/companies/nichirei-back-cyberattack/)
- [Cyber Attack on Major Japanese Refrigerated Logistics Provider Disrupts KFC and Other Food Chains](https://www.cpomagazine.com/cyber-security/cyber-attack-on-major-japanese-refrigerated-logistics-provider-disrupts-kfc-and-other-food-chains/)
- [Nichirei Cyberattack Disrupts KFC Japan Supply Chain](https://thecyberexpress.com/nichirei-cyberattack-disrupts-supply-chain/)
- [Freezer food giant's system fault disrupts KFC in Japan: No chicken sold as stores shorten hours](https://english.dotdotnews.com/a/202607/17/AP6a58aee2e4b04b6c5d339ec1.html)
- [Threat Profile: RansomHouse](https://blog.scilabs.mx/threat-profile-ransomhouse/)
- [RansomHouse Threat Group Profile](https://www.halcyon.ai/threat-group/ransomhouse)
- [RansomHouse: Stolen Data Market, Influence Operations & Other Tricks Up the Sleeve](https://analyst1.com/ransomhouse-stolen-data-market-influence-operations-amp-other-tricks-up-the-sleeve/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1639