Nichirei cyberattack: a supplier's outage is your stockout

A supply chain cyberattack doesn't have to hit you to close you. In mid-July, hackers took down servers at Nichirei, Japan's largest cold-chain logistics operator, and within days KFC Japan was pulling items off menus, cutting hours, and suspending online ordering across more than 1,300 restaurants. Nobody phished those restaurants. Their freezer just stopped refilling.

What actually happened

Nichirei detected the intrusion on July 13 and disconnected systems to contain it, beginning a gradual restoration on July 14, per SecurityWeek. The company said personal information stored on affected servers may have been exposed and that it is still investigating.

The blast radius is the story. The Record reports Nichirei Logistics Group runs roughly 140 refrigerated distribution centers serving about 5,000 customers. Downstream: KFC Japan's 1,300-plus locations, Aeon supermarkets, the Hotto Motto bento chain, Yayoi Ken, Kura Sushi, and frozen food manufacturer TableMark. Nichirei's own line — that it's difficult to deliver orders as they're placed — is what an outage looks like from the receiving dock.

The extortion group RansomHouse claimed responsibility on its leak site on July 22, according to The Japan Times. Nichirei has withheld technical details and has not publicly confirmed the claim, so treat attribution as unsettled.

Why this supply chain risk matters for your business

You probably have a Nichirei. One 3PL, one distributor, one payment processor, one EDI feed — a vendor whose bad week becomes your closed sign. Most operators have never written down which one it is.

Start there, and be specific. List every vendor whose outage stops you taking or fulfilling an order, and next to each, write the number of days you survive without them. That column is your actual exposure, and it's usually shorter than people guess. Then build the manual path before you need it: a second approved supplier with an account already open, a phone-and-spreadsheet ordering fallback your staff has actually rehearsed, and a current export of your own order, inventory, and customer data sitting somewhere you control. If your inventory counts only exist inside a partner's portal, their incident is your data loss too.

None of this prevents a vendor from getting hit. It changes whether you lose a week or a day. We've written about vendors controlling their own disclosure and your vendor's vendor holding your data. This is the physical version, and it ends with an empty shelf.

Sources: SecurityWeek, The Record, The Japan Times.