TOMOKU: ransomware encrypted group servers and stopped its online order system, and staff personal data and more may have leaked

1. 2025-05-03

   Some group servers were encrypted in a ransomware attack. [1] [2]

2. 2025-05-08

   It announced the attack. The online order system failed, but ordering by web, fax and email, the website and email kept running, and production continued as usual. [1]

3. 2025-07-22

   In a follow-up it said outside experts found a vulnerability in network equipment to be the cause of the breach. Some of the information it holds may have leaked, and systems had been restored. [2] [3]

The information that may have leaked is the names, addresses, phone numbers and email addresses of staff, and information used in its business. No count was published. No secondary harm was confirmed. [2] [3]