Asahi ransomware attack puts data of 1.914 million people at risk as Japan operations recover

Customer data fears deepen a national supply disruption

Asahi Group Holdings says personal information linked to approximately 1.914 million people, including about 1.525 million customers, was or may have been exposed in a ransomware attack that disrupted its operations across Japan. Preliminary findings published in late November have widened the crisis beyond stalled beer deliveries to the privacy of customers, employees, their families and business contacts.

Japan's largest brewer detected the disruption at one of its data centers on September 29. Staff discovered encrypted files around 7:00 a.m. Japan time and isolated the affected center within hours. By then, the attacker had moved through parts of the network, scrambled data and disabled services used to take orders, arrange shipments and support customers.

Asahi's domestic operations turned to pen, paper, telephone and fax to keep products moving. Brewery production slowed, deliveries stalled and shops reported dwindling stocks of beer and soft drinks. Asahi Super Dry was among the products affected, while convenience stores warned customers about delays.

As of November 28, 2025, Asahi had definitively confirmed the leakage of 18 items of employee information from company laptops. Its investigation also found that a much larger collection of personal information held on servers could have been accessed. Credit card details do not appear in the compromised data sets.

Qilin, a ransomware group, has claimed responsibility and says it stole about 27 gigabytes of company files. Asahi has not confirmed a public release of stolen data. Production and shipments are returning in stages, but the company has given no final recovery date.

How the attackers moved through Asahi's network

Asahi's internal review points to an intrusion that began before staff discovered the encrypted files. Later forensic work indicates that the initial breach likely involved compromised equipment at another company site. That access allowed the attackers to move inside the network before the affected data center was isolated.

The attackers then deployed ransomware across multiple servers and connected devices. Ransomware scrambles data so that an organization cannot use it normally, and criminals demand payment in connection with restoring access. At Asahi, the disruption reached order entry, distribution and customer support, services needed to run daily operations.

Isolating the data center was part of the containment response, but the intruder had already reached other parts of the business network. The company brought in outside specialists, established an emergency response structure and began checking systems while rebuilding parts of the network taken offline.

The main developments span nearly two months:

• September 29: Asahi discovered encrypted files around 7:00 a.m. Japan time and isolated an affected data center within hours.
• During the disruption: Staff used manual records, telephone calls and fax as ordering and shipping systems became unavailable. Production and deliveries slowed.
• Late November: Preliminary investigation findings identified approximately 1.914 million people whose information was or may have been exposed.
• By November 28: Production had restarted at several plants, shipments were resuming in stages and the investigation remained active.

Whose personal information is at risk?

Asahi's assessment covers four groups: approximately 1.525 million customers, 107,000 current and former employees, 168,000 employee family members and 114,000 external contacts. Together, those figures total about 1.914 million people. Customers account for roughly four out of every five people in that total.

The customer records include people who contacted support desks. External contacts include business contacts who received ceremonial messages. The records also contain information about employees, former staff and their families, making the potential exposure broader than a customer contact list.

Names, gender, dates of birth, postal addresses, email addresses and telephone numbers are among the information that may have been exposed. Depending on the category of record, the data may also include details about a person's relationship with the company.

Asahi's advisory identifies the following types of information:

• Full names and contact details, including postal addresses, email addresses and telephone numbers.
• Gender and dates of birth.
• Company relationship details for employees, former employees and family members.
• Business contact information for external partners and contacts.

Asahi is preparing direct notifications for affected individuals. Its investigation has confirmed 18 leaked items of employee information from laptops, while the much larger server collection remains potentially exposed. The investigation is continuing, and payment card data is outside the compromised sets identified by the company.

Why stolen files create a second crisis

Qilin listed Asahi on its leak site and claimed to have taken about 9,300 files, totaling approximately 27 gigabytes. The claim places a threat of publication alongside the disruption caused by encrypted systems.

Security teams call this approach double extortion. Criminals first steal sensitive files, then scramble data or systems to interrupt operations. They threaten to publish the stolen information if a ransom is not paid. Victims must deal with business interruption and the possible exposure of private information at the same time.

Asahi says it has not seen confirmable evidence of a public data dump. The threat of publication still adds pressure as the company restores services, investigates the breach and addresses privacy and reputational risks.

Kevin Marriott, a senior manager of cyber at Immersive, said data theft complicates recovery because rebuilding customer trust and restoring operations follow different schedules. He warned that full stability may take months.

The theft of customer data adds further pressure to the Asahi team, in addition to the possibility that operations may not be fully restored until February.

Marriott's reference to February describes a possible recovery timescale. Asahi has not announced that month as a completion date.

What Qilin's operating model means

Qilin operates through ransomware as a service. Under that model, an operator supplies malware and supporting infrastructure to affiliates, who break into targets and share any profits. The operation involves a platform and multiple attackers rather than one group carrying out every intrusion itself.

Security researchers have tracked hundreds of claimed Qilin attacks since the operation emerged in 2022. Reporting in 2025 places it among the world's most active ransomware crews, with manufacturing among the sectors facing heavy pressure.

Qilin's tools are designed to attack corporate information technology environments and, when reachable, industrial systems. Its code includes components written in Rust and C, programming languages used to build software. The tools can be deployed across Windows, Linux and VMware ESXi systems.

Threat intelligence also indicates that Qilin instructs affiliates to avoid targets in certain countries, including Russia and Belarus. Its claimed attack on Asahi forms part of a wider pattern of pressure on manufacturers whose production and deliveries depend on functioning digital systems.

Why a computer outage stopped beer deliveries

Asahi's breweries depend on connected software for order management, raw material planning, batch recipes, packaging schedules, warehousing and logistics. A brewery needs more than working tanks and bottling machines: it also needs information about what to produce, which materials are available and where finished products should go.

When the corporate network is encrypted or taken offline, that coordination can stop. Production can suffer even when programmable logic controllers, the devices that control machinery on the factory floor, remain untouched. Missing order information or unavailable scheduling systems can interrupt a line whose physical equipment is still intact.

Manufacturers are attractive targets because they cannot easily hide an outage. Production, packaging and distribution are tightly connected to business systems in data centers and the cloud. Analysts tracking attacks on manufacturers estimate that downtime can cost large firms close to $2 million a day.

Asahi's disruption showed how an interruption to digital services can affect a national distribution network within hours. Japanese retailers reported shrinking stocks of Asahi Super Dry, and stores warned customers about delayed supplies. Staff processed orders by hand and used telephone and fax as alternatives.

Security teams studying industrial incidents say attackers often enter through a corporate network and then move toward systems supporting a plant. Those systems may handle shared files, authentication, scheduling or remote access. Without separated networks and strong checks on access, a compromise can spread across sites.

Asahi has restarted production at several plants and is increasing shipments as systems return. Its response continues alongside efforts to maintain supply through alternative arrangements.

Asahi's apology and recovery program

Atsushi Katsuki, Asahi Group president and CEO, apologized to customers, partners and employees while the company worked to restore normal service. He described system restoration and continued product supply as parallel priorities.

I would like to sincerely apologise for any difficulties caused to our stakeholders by the recent system disruption. We are making every effort to restore the system as quickly as possible, while implementing alternative measures to ensure continued product supply to our customers.

Asahi's emergency response includes outside specialists and a program lasting several months to contain the breach, restore systems and strengthen defenses. Teams are checking system integrity and rebuilding parts of the network that were taken offline during containment.

The company says its security work includes tighter controls on network communications, upgraded monitoring and new backup designs intended to shorten recovery time. It also plans more rigorous employee training, stronger governance and regular external audits.

Asahi has postponed the release of full year financial results to focus on response and restoration. Production and shipment recovery is taking place in stages as the company works through both operational disruption and the investigation into personal information.

The outage was limited to systems managed in Japan. Asahi's international brands, including Peroni, Pilsner Urquell, Grolsch and Fuller's Brewery in the United Kingdom, did not experience outages.

Protecting the connections between offices and factories

Jason Revill, global security practice technology lead at Avanade, said the incident shows why companies need stronger protection where corporate information technology and operational technology meet. Operational technology refers to the systems used to control and support physical processes such as factory production.

Revill called for a zero trust approach, under which access is continuously verified. The aim is to limit how far an attacker can move after gaining entry to one part of a business.

The Asahi cyberattack highlights a growing risk in operational technology and information technology coverage networks, and why Zero Trust principles are critical for every organization.

Network segmentation serves a related purpose by separating parts of a network and controlling communication between them. For a manufacturer, those boundaries can help contain a breach before it reaches services supporting other plants or distribution sites.

Japan faces a wider ransomware wave

Japan's National Police Agency has reported record levels of ransomware cases since 2024. Surveys of Japanese companies show that shutdowns frequently last more than a week, with some continuing much longer and bringing heavy recovery costs.

Recent attacks on large Japanese companies, including businesses in optics and publishing, forced suspensions lasting several weeks and caused material losses. Across the Asia Pacific region, reported ransomware activity has risen sharply since 2024, with manufacturers among the most affected organizations.

Japan partially enacted a new framework for active cyber defense in 2025, aimed at reducing harm from ongoing attacks against critical sectors. Private companies continue to carry the immediate responsibility for prevention and response.

Sector specialists warn that attackers are moving through networks and encrypting systems faster, leaving less time for detection and containment. Short intervals between initial compromise and ransomware deployment make preparation and rehearsed responses more pressing.

Chris Dimitriadis, chief global strategy officer at ISACA, said organizations need regular practice and investment to respond to the speed and precision of recent attacks.

The window to detect and stop an attack is shrinking, with criminal tactics moving faster. Organizations need proactive cybersecurity prevention and training as core business priorities, with frequent incident response exercises and a culture of shared digital responsibility.

Practical steps for manufacturers

Brewers, food producers and other manufacturers with complex logistics can review the weaknesses ransomware crews commonly exploit. The Asahi incident connects several areas that need attention: access controls, the links between corporate and plant systems, recovery arrangements and the ability to act quickly during an intrusion.

Companies reviewing their defenses can take these steps:

• Map connections between corporate information technology and plant systems, then separate networks to limit an attacker's movement. Require authentication using multiple factors for remote access and administrative roles.
• Strengthen identity systems, remove unused accounts and monitor unusual logins. Require strong passwords and second authentication factors that resist phishing.
• Prioritize patches for equipment exposed to the internet, remote access gateways and directory services. Monitor vulnerabilities in both corporate and operational environments.
• Build reliable backups isolated from everyday network access and test them regularly. Check that critical business systems and services supporting plants can be restored quickly.
• Deploy endpoint detection and response across servers and workstations. This software looks for suspicious activity on devices and supports a response. Send alerts to a team able to assess and act on them around the clock.
• Create and rehearse an incident response plan involving executives, legal teams, operations and communications. Use discussion exercises and live drills to practice decisions.
• Review security expectations for managed service providers and critical vendors. Require timely notification of breaches.
• Inventory operational technology and supporting systems. Remove unnecessary connections, reduce remote access routes and validate changes through change control.

Backups and rehearsals address different parts of recovery. Backups support the restoration of systems and data; exercises prepare people to coordinate operational, legal and public communication decisions during a disruption.

What affected people can do

Customers who contacted Asahi's support desks face a risk of targeted phishing. Criminals can use real names and contact details to make fraudulent messages appear convincing. An email or text may imitate an order confirmation, refund or delivery notice to encourage a reply, a click or the disclosure of information.

Employees, former staff, family members and external contacts should also watch for suspicious approaches while Asahi prepares notifications. Practical precautions include:

• Be cautious about unsolicited calls, texts or emails requesting personal information. Avoid links and attachments from unknown senders.
• Check messages about orders or deliveries directly through the company's website or customer service, using a trusted telephone number.
• Change passwords on accounts using the email address shared with Asahi, especially where passwords have been reused. Enable authentication using multiple factors where available.
• Monitor bank and card statements for unusual charges. Asahi says payment card information was not exposed, but criminals may attempt related scams.
• Watch postal mail and email for targeted phishing over the coming months. Attackers may reuse breached contact lists.
• Consider identity protection or credit monitoring services if you believe your personal information was exposed.

Asahi is working on two linked tasks: restoring the systems that keep products moving and identifying people whose information was exposed or may have been accessed. Direct notifications and the continuing investigation will guide the privacy response, while system checks and staged restoration govern the return of normal operations.

Key Points

• Asahi detected ransomware on September 29, disrupting ordering, shipments, customer support and production across Japan.
• Information linked to approximately 1.914 million people was or may have been exposed, including about 1.525 million customers.
• Asahi confirmed 18 leaked items of employee information. Credit card details do not appear in the compromised data sets.
• Qilin claimed responsibility and said it stole about 9,300 files totaling 27 gigabytes. Asahi has not confirmed a public data release.
• Plants and shipments are restarting in stages after manual processing and shortages. No final recovery date has been announced.
• International brands, including Peroni, Pilsner Urquell, Grolsch and Fuller's Brewery, did not experience outages.
• Asahi is preparing notifications, strengthening security and postponing full year financial results while recovery continues.
• Japan and the wider Asia Pacific region face rising ransomware pressure, with manufacturers among the businesses most exposed to costly disruption.