Security LabInspect with AI
← Incident database

askul-2025 · Disclosed 2025-10-19

ASKUL: access through an MFA exception

Stolen credentials for a contractor administrator account without MFA enabled a ransomware intrusion.

Credentials

Outcome: Confirmed breach

Entry path and evidence

  • Reported fact

    A contractor account was misused; the original credential leak remains unresolved.

    [s1]p.4 §6(1) 不正アクセス
  • Reported fact

    Some servers lacked EDR and continuous monitoring; encrypted or deleted backups impeded recovery.

    [s1]p.3 §4-2 / p.4 §6(2)・(3)
  • Reported fact

    ASKUL reported that an OS update erased relevant contractor-PC logs, limiting the origin investigation.

    [s1]p.4 §6(1) 調査により判明した事項

Timeline

  1. Incident disclosed. [s1]

Reported response

  • Reported fact

    ASKUL reported credential resets, MFA rollout, and environment rebuilding.

    [s1]p.4 §5-2 / p.4–5 §7-1・7-2

Cause and mitigation hypotheses

These are editorial hypotheses, separate from established causes and reported responses. Supporting and challenging observations are checks to investigate, not collected evidence.

  1. Cause hypothesis 1 Unverified

    Acquisition of administrator credentials from the contractor endpoint remains a candidate origin.

    Primary-source starting point

    Account misuse was confirmed, but relevant contractor-PC logs are unavailable.

    [s1]p.4 §6(1)

    Read assumptions, observations, and limits
    Required assumptions
    • The credentials were used or stored on the contractor endpoint before entry.
    Observations that would support it
    • Preserved endpoint or EDR records show credential access or transfer before the first login.
    Observations that would challenge it
    • A documented leak elsewhere and its timing contradict the endpoint-origin explanation.
    Assessment limits
    • Missing logs are not proof of compromise; phishing and other storage origins remain possible.

    Related inspection rules

  2. Mitigation hypothesis 2 Unverified

    Removing contractor MFA exceptions could reduce remote entry using passwords alone.

    Primary-source starting point

    The misused contractor administrator account had an MFA exception.

    [s1]p.4 §6(1)

    Read assumptions, observations, and limits
    Required assumptions
    • Entry depends on password authentication rather than stolen sessions or another path.
    Observations that would support it
    • IdP policies and logs show no contractor or emergency exception; a synthetic isolated test rejects password-only access.
    Observations that would challenge it
    • Legacy or exempt access bypasses the extra factor, or a stolen session still grants access.
    Assessment limits
    • MFA alone does not prevent credential leaks, endpoint compromise, or backup destruction.

    Related inspection rules

Read this incident’s AI-ready guide ↗

Evidence relevant to prevention

Operational controls to inspect

Inspect MFA exceptions and contractor privileges, plus protected backups and restoration tests.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence.

Credential theft origin is unresolved; the report found no evidence that the VPN vulnerability was exploited.

Sources

  1. [s1] ASKUL · Primary source

    ランサムウェア攻撃の影響調査結果および安全性強化に向けた取り組みのご報告（第13報） ↗

    Published 2025-12-12 · Reviewed 2026-10-10