Nichirei and the second clock: shipments came back, the files did not

In mid-July 2026, a cyberattack halted operations at Nichirei, one of Japan’s largest frozen-food producers and cold-chain logistics operators. According to Kyodo News reporting, the outage delayed frozen-food deliveries to supermarkets and food-service customers, across a client base reports put at roughly 5,000 logistics customers, and KFC Japan shortened operating hours at some locations while ingredient supply recovered. On July 21 the group RansomHouse claimed responsibility in a dark-web post, said it had taken internal company data, and reportedly released a sample as proof. Nichirei acknowledged the claim, declined to detail the attack, and said on July 22 that it had notified people whose personal information may have been leaked. No ransom figure has been made public.

Physical logistics recovered fast. Deliveries were restored on July 21, and KFC Japan reported normal operations the next day. That is a credible operational response to a hard week. It is also exactly half of the incident, because a ransomware event that steals files runs two clocks at once, and only one of them stopped.

The operational clock is measured in days. Systems come back, orders reflow, trucks move, and the headline resolves itself. Everyone in the business can see that clock, and every recovery plan is built around it.

The second clock starts the moment files are copied off, and it does not stop. Once documents are in someone else’s possession, restoration is irrelevant to them. Notification obligations, partner disclosures, regulator questions, and the possibility of publication all sit on that second clock, and the organization controls almost none of it.

Backup and vault architectures answer the first clock well. They return a good copy after an event. They are not designed to observe that data was read and copied, and they cannot recall a document that has already been posted. When the extortion leverage is exfiltrated files, recovery tooling is answering a different question than the one being asked.

The most instructive detail in the public account is a single hedge. The company notified people whose personal information may have been exposed. Nearly every organization ends up saying some version of that sentence, because the evidence needed to say something more precise was never captured at the layer where the files were actually read.

The usual instrumentation does not close the gap. Application logs record intent. Network telemetry records movement. Native file-server auditing could in principle record the reads, but in practice it is switched off or narrowed for performance reasons, and its logs live where an intruder with credentials can edit them. None of it reliably answers which files a session opened, in what order, and whether it read them or merely listed them.

An immutable, per-operation audit trail at the storage layer does, across SMB, NFS, S3, and Web Drive, and it holds up precisely because the record cannot be altered by whoever gained access. The difference between notifying everyone as a precaution and notifying the people actually affected is not legal caution. It is whether the data path kept a record worth trusting.

Food production and logistics belong on the same list as utilities and manufacturing. The operational technology gets the security attention because it stops trucks. Meanwhile the file estate holds employee records, supplier contracts, product specifications, and route and inventory data, the kind of material extortion groups price. A useful first step costs nothing: list the shares that hold partner and personal data, and ask what record would exist today if a credentialed session read all of them overnight.

Answering both clocks takes controls that sit in the data path. Active Defense profiles normal access per user, host, and dataset and terminates a session whose behavior breaks the pattern, which is the only intervention available while an exfiltration is still in progress. Attribute-based access control narrows what any one compromised account can reach in the first place. Intelligent Bulk Remediation restores exactly the files an attack touched rather than rolling back a whole dataset and losing a week of legitimate work. And the audit record underneath them is what replaces "may have been leaked" with a list.

Nichirei restarted its shipments in a week, and that part of the response deserves the credit it got. The second clock is the one to plan for, because after the copy completes there is nothing left to decide.