Loading story…
Asahi Group Holdings, Japan's largest brewing company, suffered a significant ransomware attack in September that disrupted its Japanese operations and led to the exposure of personal data belonging to nearly 2 million individuals. The Qilin ransomware group claimed responsibility, stating it had stolen 27 GB of internal files, including employee records, contracts, and financial documents. The breach affected 1.525 million customer service contacts, 114,000 external contacts, 107,000 current or former employees, and 168,000 family members, with exposed data including names, addresses, phone numbers, email addresses, and in some cases, dates of birth and gender. Credit card information was reportedly not compromised. The attack forced Asahi to suspend order processing, shipments, and customer service operations in Japan, though international branches were not impacted.
The attackers gained access via compromised network equipment at a Japanese datacenter, deploying ransomware that encrypted data on multiple servers and connected PCs. Asahi responded by isolating the datacenter within hours and has since pledged to notify all affected individuals. While some stolen data was found online, the company continues to investigate the full scope of the breach. The incident highlights the operational and reputational risks posed by ransomware attacks, especially when large volumes of sensitive personal data are involved.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
By late November, Asahi said it had isolated the affected datacenter within hours of the attack and was restoring systems cautiously in phases while implementing stronger security measures and external reviews. Shipments were resuming gradually, but reporting indicated logistics might not be fully restored until February.
In a detailed impact assessment published on November 27, Asahi said the ransomware incident likely exposed personal data associated with roughly 1.5 million to nearly 2 million people, including customer-service contacts, message recipients, employees, retirees, and employees' family members. The company said exposed data included contact and limited demographic information, but not credit card data.
The ransomware incident disrupted accounting systems badly enough that Asahi's full-year earnings report for the fiscal period ending December 31 was delayed by more than 50 days. The delay reflected the continuing business impact of the September attack.
After the attack, the Qilin ransomware group claimed responsibility, alleging it stole 27GB of data and published samples on its Tor leak site. Asahi said it had not confirmed publication of certain server-stored personal data, though some reports said stolen data was later found online.
Asahi publicly confirmed on October 3 that the September incident was a ransomware attack. The company began disclosing the operational impact and recovery efforts tied to the breach.
Following the September 29 incident, Asahi suspended operations at its Japanese branch and shifted some processes to manual handling. Ordering, shipping, call center, production, logistics, and accounting functions were disrupted.
In late September 2025, attackers accessed Asahi's environment through compromised network equipment at a group site in Japan and deployed ransomware across multiple servers and some PCs the same day. The intrusion affected Japan-managed systems and disrupted core business operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcetechrepublic.com
Open sourcetherecord.media
Open sourcego.theregister.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Asahi Group Holdings, a major Japanese brewery, suffered a significant cyberattack at the end of September, which has now been attributed to the Qilin ransomware group. The attack initially caused widespread system failures, forcing Asahi to shut down its ordering, shipping, and call center operations across Japan. Early statements from the company assured stakeholders that customer and employee data remained secure, but subsequent investigations revealed traces of unauthorized data transfers. Asahi has since acknowledged the possibility that personal information may have been compromised during the incident. The Qilin ransomware group has claimed responsibility for the attack, boasting of exfiltrating approximately 27 GB of sensitive files. These files reportedly include financial records, contracts, employee details, forecasts, and other confidential documents. Samples of the stolen data, reviewed by journalists, appear to confirm the theft of personal information, such as employee ID cards and personal documents. The breach has had a tangible impact on Asahi's domestic logistics, resulting in delayed shipments and looming stock shortages throughout Japan. Production at all breweries has resumed, but IT systems remain impaired, forcing staff to revert to manual processes like pen, paper, and fax machines for order processing. The company has postponed its quarterly financial results announcement due to the ongoing disruption and uncertainty surrounding the full extent of the breach. Asahi is actively investigating the scope of the data compromise and has committed to notifying affected individuals and complying with relevant data protection laws. The incident has raised concerns about the security of corporate and personal data within large manufacturing organizations. The attack highlights the operational risks posed by ransomware groups targeting critical business infrastructure. Asahi's response includes efforts to restore systems and mitigate further damage, though a timeline for full recovery has not been provided. The company has publicly stated its commitment to transparency and regulatory compliance as the investigation continues. The Qilin group’s public disclosure of stolen data samples has intensified scrutiny and pressure on Asahi to address the breach. The incident underscores the growing threat of ransomware to global supply chains and the importance of robust cybersecurity measures in the manufacturing sector. Asahi’s experience serves as a cautionary tale for other organizations regarding the potential consequences of cyberattacks on both business operations and data privacy.
Jul 12, 2026
Asahi Group Holdings, one of Japan's largest brewery and food companies, suffered a significant ransomware attack that severely disrupted its domestic operations. The breach was first disclosed on September 29, when Asahi immediately shut down its manufacturing operations and isolated affected systems to contain the incident. This rapid response led to a halt in ordering and shipment systems, as well as the suspension of call-center operations across the brewery, soft drink, and food divisions. The disruption resulted in a shortage of Asahi's popular beer brands in Japan, impacting both retailers and consumers. Four days after the initial disclosure, the Qilin ransomware-as-a-service group claimed responsibility for the attack, posting screenshots purportedly showing internal Asahi documents as evidence. Asahi's CEO, Atsushi Katsuki, publicly apologized for the shutdown and assured stakeholders that the company was working diligently to restore systems and resume normal operations. The company established an Emergency Response Headquarters to investigate the nature and scope of the data breach, with ongoing efforts to determine whether unauthorized data transfers occurred. External cybersecurity experts were brought in to assist with the investigation and recovery process. Asahi began implementing manual operations to maintain some level of product supply and announced plans for a gradual resumption of call center activities. The company stated that the impact of the system disruption was limited to Japan, and no clear timeline for full recovery was provided. The financial impact of the incident for the fiscal year 2025 had not yet been detailed at the time of reporting. The attack on Asahi is part of a broader trend of increasing ransomware incidents targeting manufacturers and critical supply chains in the Asia Pacific region. The incident highlights the vulnerability of industrial control systems and operational technology environments to ransomware threats. Asahi's experience underscores the importance of rapid incident response, transparent communication, and collaboration with cybersecurity professionals during major cyber crises. The company continues to investigate the full extent of the breach and is working to restore all affected systems as quickly as possible. The attack has raised concerns about the resilience of food and beverage supply chains in the face of sophisticated cyber threats. Asahi's efforts to implement alternative measures and manual processes demonstrate the challenges organizations face in maintaining operations during prolonged system outages. The incident serves as a warning to other manufacturers about the growing risks posed by ransomware groups targeting critical infrastructure and supply chains.
Jun 29, 2026
Asahi Group Holdings, Japan's largest brewing company, experienced a significant cyberattack that resulted in a system failure affecting its domestic operations. The company announced that the attack forced the suspension of order and shipment operations at its group companies within Japan, directly impacting its ability to distribute products and fulfill customer orders. In addition to halting logistics, Asahi also suspended its call center and customer service desk operations, leaving customers and business partners unable to access support or place new orders. The company emphasized that, as of the latest updates, there was no evidence of personal information or customer data being leaked to external parties. Asahi's international operations, including those in Europe and other regions, remained unaffected by the incident, with the disruption limited strictly to its Japanese business units. The company, which owns a portfolio of well-known beverage brands such as Peroni and Grolsch, reported over $9 billion in revenue for the first half of 2025, highlighting the potential scale of the operational impact. Asahi stated that it is actively investigating the cause of the system failure and working to restore normal operations, but it has not provided an estimated timeline for recovery. No ransomware group or cybercriminal organization has publicly claimed responsibility for the attack, and Asahi has not confirmed whether ransomware was involved. The incident comes amid a broader trend of cyberattacks targeting beverage and food manufacturing companies globally, with several high-profile breweries and distributors in other countries having faced similar disruptions in recent years. The domestic Japanese market is particularly significant for Asahi, accounting for approximately half of the company's profits, which underscores the seriousness of the operational shutdown. The company has issued public apologies for the inconvenience caused to customers and business partners and continues to provide updates as the investigation progresses. Industry observers note that the attack on Asahi is part of a growing pattern of cybercriminals targeting large, high-profile companies in the food and beverage sector. The company has not disclosed specific technical details about the nature of the attack or the vulnerabilities exploited. Asahi's swift action to suspend affected systems is seen as a precautionary measure to contain the incident and prevent further damage. The ongoing investigation will determine whether any additional security measures or disclosures are necessary as more information becomes available.
Jun 29, 2026