Nichirei and the second clock: shipments came back, the files did not

In mid-July 2026, a cyberattack disrupted operations at Nichirei, one of Japan’s largest frozen-food producers and cold-chain logistics operators. According to public reporting from Jiji Press and Kyodo News, the incident delayed deliveries of frozen foods to supermarkets and food-service customers, with Japan KFC shortening operating hours at some locations while ingredient supply was restored. Reporting put the number of affected business partners at roughly 5,000. The group RansomHouse claimed responsibility on a dark-web leak site around July 22, said it had taken internal company data, and reportedly released a sample as proof. Nichirei acknowledged the claim, declined to detail the attack, and said on July 22 that it had notified people whose personal information may have been leaked. No ransom figure has been made public.

Physical logistics recovered quickly. Business partners including KFC Japan were told on July 21 that ingredient deliveries had been restored. That is a credible operational response to a hard week. It is also only half of the incident.

A ransomware event that halts a cold chain runs two clocks at once, and they run at wildly different speeds. The operational clock is measured in days. Systems come back, orders reflow, trucks move, and the headline resolves itself. Everyone in the business can see that clock, and every recovery plan is built around it.

The second clock starts the moment files are copied off, and it does not stop. Employee records, product management data, and correspondence with business partners are documents. Once they are in someone else’s possession, restoration is irrelevant to them. Notification obligations, partner disclosures, and the possibility of publication all sit on that second clock, and the organization controls almost none of it.

This is worth stating without overselling: backup and vault architectures address the first clock well. They return a good copy after an event. They are not designed to observe that data was read and copied, and they cannot recall a document that has already been posted. When the extortion leverage is exfiltrated files, recovery tooling is answering a different question than the one being asked.

The most instructive detail in the public account is a single hedge. The company notified people whose personal information may have been exposed. Nearly every organization ends up in that position, because the evidence needed to say something more precise was never captured at the layer where the files were actually read.

Application logs record intent. Network telemetry records movement. Neither reliably answers which specific files a session opened, in what order, and whether it read them or merely listed them. An immutable, per-operation audit trail at the storage layer does, across SMB, NFS, S3, and Web Drive, and it holds up because the record cannot be altered by whoever gained access. The difference between notifying everyone as a precaution and notifying the people actually affected is not a matter of legal caution. It is a matter of whether the data path kept a record worth trusting.

Food production and logistics belong on the same list as utilities and manufacturing. The operational technology gets the security attention because it stops trucks, and meanwhile the file estate holds employee records, supplier contracts, product specifications, and route and inventory data. That is the material extortion groups price.

Detection has to sit in the data path to matter here. A session that suddenly reads or encrypts files across shares at a rate no user or application has ever produced is behaviorally obvious to something evaluating every operation inline. Active Defense profiles normal access per user, host, and dataset and terminates the session when the pattern breaks, which is the only intervention available while the exfiltration is still in progress. Attribute-based access control narrows what any one compromised account can reach in the first place, and Intelligent Bulk Remediation restores exactly the files an attack touched rather than rolling back a whole dataset and losing a week of legitimate work.

Nichirei restarted its shipments. Handling the second clock takes controls that were in place before the attack started, because after the copy completes there is nothing left to decide.