Kantsu: ransomware stops Cloud Thomas and other warehouse systems, halting client shipments

On 13 September 2024 logistics provider Kantsu said it had detected server failures from about 6 p.m. the day before and found ransomware on some servers. It cut its network off from clients and the outside. On 25 September it said postal codes, addresses, names, phone numbers and order data registered in its services may have leaked, and that it was building its cloud services in a new environment separate from the damaged one. Its Cloud Thomas warehouse management system and other systems stopped, and e-commerce clients reported delayed or halted shipments and closed sites. In its final report of 18 October it said monitoring of leak sites had found no publication of its data and no leak had been confirmed. Its president told CIO that the attackers got in through a vulnerability in an SSL-VPN device. CHOYA shops reported a possible leak of delivery information on 4,739 people; that is one client subset, not the supplier-wide total.