Responding to business partners cost Kantsu approximately 1 billion yen after ransomware struck in September 2024. That was the largest share of the e-commerce logistics company’s approximately 1.7 billion yen in calculated damage, not the bill for repairing its servers.
The estimate came from a lecture by Toshimoto Tatsushiro, Kantsu’s president at the time. Client compensation and service fees that could no longer be billed made up the approximately 1 billion yen.
Restoration, forensic investigation, legal expenses and disposal accounted for the other approximately 700 million yen.
Six servers and compromised backups
An employee’s report on September 12, 2024, marked the first sign of trouble that evening. They “could not connect to the internet.”
Ransomware encrypted all six servers in Kantsu’s data center. The backups were compromised too, while internal core systems and attendance management stopped working.
One system escaped. Financial accounting had made its cloud move 11 days earlier and remained safe.
Kantsu handles logistics for e-commerce companies and develops warehouse-management systems. A shutdown therefore reaches beyond its own operation: customers cannot dispatch goods even when orders continue arriving.
That dependency helps explain why money paid to clients and revenue that could not be collected dwarfed the direct server expense. The lecture did not identify payments to individual shippers or specify precisely how long shipments stopped.
A bill exceeding 10% of annual sales
Kantsu recorded 15.2 billion yen in sales during the year of the attack. Its estimated damage exceeded 10% of that amount.
The operational effects lasted beyond the initial restoration work. From September through December, a period of about three months, the company could not undertake new sales activities.
Tatsushiro borrowed approximately 2 billion yen for recovery and estimates that rebuilding the company’s finances will take about four years.
The approximately 1.7 billion yen calculation needs careful handling when compared with financial statements. It includes unbilled usage fees, which may not appear in the same form as an extraordinary loss. The financial-statement figure was smaller.
Client responses represented about 60% of the lecture’s total. That proportion is specific to Kantsu; contractual compensation limits, insurance and the amount of work performed internally could produce a different result elsewhere.
The outsourcing question
Companies providing logistics, business-process outsourcing or systems that partners use every day carry a particular exposure. When they stop, a customer’s sales may stop as well. A business whose work is entirely internal instead faces its own delayed revenue.
Tatsushiro’s test is direct: “If we stopped for a week, whose sales would stop?”
Kantsu’s experience was not isolated. A Nikkei Cross Tech survey examined 52 companies that disclosed losses in financial statements. Ransomware caused the losses at 35 of them, and every loss above 1 billion yen was attributed to ransomware.
The survey did not provide breakdowns comparable to Kantsu’s client-response share.
Checks outside the server room
For contractors whose interruption would halt a customer’s business, preparation extends beyond technical recovery. Contracts need clear compensation and responsibility provisions. A shutdown plan should name who will contact partners and identify alternative telephone or email channels.
Companies also need to know which tasks staff can perform manually or from another location when systems are unavailable. Those arrangements address the category that consumed most of Kantsu’s calculated loss.
Tatsushiro chose to discuss the incident publicly because he viewed victims’ reluctance to disclose their experiences as a problem. His recollection was blunt: “I tremble when I remember it.”
In April 2026, Kantsu established Cyber Governance Lab as a subsidiary to carry those lessons into its security work.
Sources
Photo: kate.sade / Unsplash (Unsplash License)
