Resuming business safely
Recovery from a cyberattack requires decisions from business staff and management as well as technical teams. Using ASKUL’s published response timeline as learning material, this article proposes a team exercise to test decisions about resuming services. It is an example of exercise design for applying knowledge, rather than an announcement of an existing programme.
ASKUL’s published response timeline
ASKUL’s official cybersecurity page records that it disconnected its network and suspended services after detecting an attack on 19 October 2025, and that unauthorised access to external cloud services occurred on 22 October. Following actions including credential resets and the application of multi-factor authentication to administrator accounts, the company explained that it progressively resumed online ordering from 12 November after determining that it was safe to do so on the basis of investigations into remaining threats [1]. This is a review of a published response timeline to inform recovery planning, not a report of a new incident in October 2026.
Recovery must cover authentication and external services
An important lesson is that restoring internal servers and safely resuming an organisation’s operations involve different scopes of work. External services, administrator accounts, contractors’ connections and access permissions remaining on devices should also be reviewed within the recovery plan. For your own environment, identify who will change each set of credentials and who will check that affected services work correctly. Where the scope of the compromise remains unclear, successful restoration alone should not be treated as sufficient grounds for resuming operations.
Test resumption decisions as a team
Use a fictional order-processing operation and present a situation in which a backup has been restored, but the possible impact on credentials for external services remains unresolved. The technical team reviews the scope of compromise, credentials and monitoring. The business team checks reconciliation with manually recorded orders and arrangements for customer support. Participants taking management roles decide which activities can resume, and when, in light of unresolved risks and temporary measures. Asking for additional information needed to make a decision is also a valid outcome of the exercise. Avoid making successful restoration the sole justification for resumption.
Review the grounds for decisions rather than scores
This is a tabletop exercise in which participants make decisions across several roles, rather than a CTF in which they search for flags. It follows Cyber Challenge’s approach of using knowledge, finding gaps and deciding what to learn next. Assess whether participants can identify the information needed for decisions, distinguish confirmed facts from unresolved questions, and define the conditions and responsible decision-maker for resumption. Afterwards, select one decision that caused uncertainty and review the knowledge and procedures it required. Repeating the exercise with the same participants under different conditions can make improvements in judgement easier to review.
Next to read
What Can You Learn from CTF? — Making Cyber Challenge More Than a Competition
Explore how reflecting on an exercise can help you identify what to learn next.
Turning Knowledge into Practice — What Can You Learn with a Cyber Range and SudoRange?
Discover how a safe exercise environment can connect knowledge with practical actions and decisions.
References
[2] IPA, Lessons learned from ransomware incidents, updated 10 September 2026 (in Japanese).