Asahi turns to paper and fax to keep beer moving after ransomware attack

A digital shutdown sends beer orders back to paper

Asahi Group Holdings, Japan's largest brewer, turned to handwritten orders, paper forms and fax machines after a ransomware attack disrupted ordering, shipping and parts of customer support across its domestic business. By October 11, 2025, limited production and deliveries had resumed, but the company was still restoring systems and investigating stolen data found online.

The disruption began on September 29, interrupting transactions and deliveries for products including Asahi Super Dry and Mitsuya Cider. With core systems offline and email from outside addresses blocked, employees processed purchase orders by hand and faxed instructions to warehouses and distributors. Phones became another way to coordinate work normally handled by computers.

Six domestic beer plants restarted on a limited basis, while convenience stores warned of possible shortages and restaurants looked for replacement supplies. The immediate task was to keep beverages reaching shops and pubs while engineers worked to recover the network. Manual processing helped restart deliveries, although service remained uneven as systems returned in stages.

Asahi chief executive Atsushi Katsuki said the company was pursuing recovery and alternative ways to supply customers at the same time.

We are making every effort to restore the system quickly while implementing alternative measures to ensure continued product supply.

The attack affected Asahi's operations in Japan. Its international businesses were unaffected, and brands in Europe and other regions continued producing and shipping normally. Within Japan, the disruption reached beyond beer into soft drinks, products made for retail chains and food items manufactured at domestic plants.

Asahi's experience shows how a computer outage can quickly become a supply problem. Factories, warehouses and delivery teams need shared information about orders, stock and destinations. Paper and fax restored some of those connections, but employees had to carry out tasks at a slower, manual pace.

How the disruption unfolded

September 29 marked the start of the system failure in Japan. Order processing, shipments and call center operations stopped. Asahi isolated affected systems to limit the spread of the attack, then began arranging alternative ways to handle orders and deliveries.

October brought a gradual restart of physical operations alongside a widening investigation into data theft. Production could resume in a limited form before the full computer network was restored, with employees using phones, fax machines and paper to coordinate supply.

• September 29: A system failure in Japan halted order processing, shipments and call center operations.
• October 2: Production restarted at six domestic beer plants on a limited basis, and manual order handling by phone and fax expanded.
• October 3: Asahi confirmed that ransomware caused the system failure and said it was investigating traces of possible unauthorized data transfer.
• October 4 to October 6: Limited shipments resumed, call centers prepared partial service, and retailers warned of possible shortages.
• October 8: The Qilin ransomware group claimed responsibility and posted samples of stolen files on a leak site. Asahi said it had found stolen data online and was investigating its scope and notification needs.

Limited shipments had restarted by Friday as teams established manual workflows. Call centers prepared to offer reduced service, while the company warned that deliveries would remain patchy during the staged recovery.

Asahi had given no estimated date for full recovery by October 11. Some systems would remain offline until checks were complete, leaving customers dependent on partial service and alternative ordering arrangements.

Why ransomware can stop deliveries

Ransomware is a form of cyber extortion. Attackers enter a company's network and scramble files so that staff cannot use them. They then demand payment in exchange for a decryption key, a tool intended to unlock the files.

Many ransomware groups also copy information before demanding money. They threaten to publish that information if the victim refuses to pay. This combination of locking systems and threatening disclosure is often called double extortion.

Asahi confirmed that ransomware had hit its servers. For a business running production and distribution around the clock, losing computer systems can immediately freeze logistics, prevent factory planning tools from seeing orders and interrupt customer service.

Disconnecting affected systems helped Asahi limit the attack's spread. It also meant employees had to replace automated processes with phone calls, fax messages and handwritten instructions. A warehouse still needed to know which products to dispatch, how much to send and where each delivery should go.

Asahi apologized to customers and business partners in a statement explaining the disruption and its recovery work.

We sincerely apologize for any inconvenience caused to our customers and business partners. We are actively investigating the cause and working to restore operations; however, there is currently no estimated timeline for recovery.

Qilin claims responsibility and publishes file samples

Qilin, a group operating a ransomware service, claimed responsibility for the attack on October 8. Its operators posted samples on a leak site on the dark web and said they had taken roughly 27 gigabytes of internal data.

The group's listings described contracts, financial documents and files relating to employees. One post referred to 9,323 stolen files and displayed several dozen images of documents as evidence of its claim.

Asahi subsequently said stolen data from the incident had been found online. The company was investigating the extent of the theft and said it would notify affected parties after confirming the details. The amount and file count were figures claimed by Qilin; Asahi's investigation into the scope of the theft was continuing.

Qilin operates through a model known as ransomware as a service. The core group supplies malicious software and supporting infrastructure, while affiliates carry out intrusions into target networks. The participants share the proceeds.

The group has targeted healthcare and manufacturing, among other sectors. Its software families can run on Windows, Linux and ESXi servers, giving it tools for different types of computer environments. ESXi is software used to run multiple virtual computers on a physical server.

Qilin often uses double extortion, combining encrypted systems with threats to release stolen data. For Asahi, restoring orders and shipments was therefore only one part of the response. The company also had to determine what information had been taken and who needed to be told.

Convenience stores warn of missing drinks

Seven & I Holdings, the operator of the Seven Eleven convenience store chain, prepared notices warning customers about suspended Asahi shipments. Convenience stores sell a large share of Japan's beer, making interruptions to their frequent deliveries a visible part of the disruption.

Seven Eleven shoppers saw notices covering Asahi Super Dry and some soft drinks. Lawson and FamilyMart also warned that several Asahi beverages, along with products made jointly with the brewer for their own store brands, could become scarce from Friday and through the weekend.

A spokesperson for Seven & I Holdings described the company's preparations while saying major disruption had not yet occurred.

We are preparing to warn customers about suspended shipments. At this stage, there are no major disruptions.

Products affected included Seven Premium Clear Cooler chuhai and bottled teas sold under convenience store brands. Chuhai is an alcoholic drink category. Supply pauses therefore reached products that shoppers might recognize by a retailer's name rather than Asahi's.

Some stores limited purchases, and operators prepared substitute items. Mitsuya Cider also faced pressure on supply, while some beverages exclusive to particular chains went on hold.

Retailers had to manage the gap between stock already on shelves and the arrival of new deliveries. Asahi's limited shipments provided some replacement stock, but the slower ordering and dispatch process left stores preparing for gaps across beer, nonalcoholic drinks and other products.

Restaurants change beer suppliers and serving formats

Marugen Ramen said deliveries of both draft and bottled Asahi beer had stopped. The restaurant chain planned to move to other suppliers once its remaining stock ran out.

Kisoji, known for shabu shabu, switched from draft beer to bottles and obtained supplies from other brewers to keep serving customers. Some izakaya pubs warned patrons that Asahi draft beer could run out if the outage continued.

Restaurants used these changes to stretch remaining inventory and bridge the delivery gap. Bottles provided an alternative where draft supplies were under pressure, while products from other brewers allowed some venues to continue selling beer after their Asahi stock was exhausted.

Bars and izakaya that rely on kegs can use up their stock faster than grocery stores because draft beer requires frequent deliveries. A delay in replenishment can therefore change what a venue is able to serve even while packaged drinks remain available elsewhere.

Customers faced a practical choice when a preferred lager was unavailable: accept another brewer's product or wait for Super Dry to return. Loyalty to its taste could influence that choice, while restaurants had to work with whatever replacement supplies they could obtain.

Six breweries restart, but manual work limits the pace

Asahi restarted all six of its domestic beer plants on a limited basis. It prioritized core products and large customers while employees continued handling orders by phone and fax.

Shipping teams focused on existing commitments and routes carrying large volumes. This directed limited capacity toward deliveries already expected by customers and toward routes that could move substantial quantities of product.

Asahi also began restarting soft drink production at selected sites and prepared other plants as systems returned. The recovery extended across several parts of the domestic business rather than following a single switch back to normal service.

Producing beverages and delivering them are linked tasks. Factories need to know what customers have ordered, warehouses need dispatch instructions, and delivery teams need schedules. Restarting a production line still leaves those coordination tasks to be completed.

Paper forms and fax messages supplied part of that missing coordination. They kept some products moving, but processing orders manually was slower than the normal automated workflow. Supply continued to arrive in limited quantities while demand from shops and restaurants carried on.

The length of the outage also mattered financially. Extended interruptions and penalties associated with products being out of stock could weigh on Asahi's earnings in the fourth quarter. The early restart of production helped limit the damage, although full service had yet to return.

Other brewers respond to replacement demand

Kirin, Sapporo and Suntory redirected supplies to restaurants and stores where practical as demand shifted away from unavailable Asahi products. Their ability to fill the gap depended on delivery capacity and existing contracts.

Replacement beer had to reach the right customers through available distribution routes. Competitors could supply some venues, but logistical limits and contractual commitments restricted how much additional demand they could meet.

Shoppers could encounter the disruption first in convenience stores and casual restaurants, where beer and soft drinks sell quickly. Many buyers were expected to choose Kirin, Sapporo or Suntory when their usual lager was missing, while others would wait for Asahi supplies to return.

For retailers and restaurants, the immediate concern was keeping products available. For Asahi, the same interruption created pressure to resume reliable deliveries before temporary substitutions and missing stock caused further losses.

Connected factories make cyberattacks a physical problem

Modern brewing depends on connected digital tools. Sensors and industrial software control production lines, warehouse robots follow planning instructions, and delivery fleets depend on schedules shared through computer systems.

The equipment and software used to run factories and logistics are known as operational technology, or OT. Corporate information technology, or IT, handles functions such as business records, communications and orders. Links between these environments help coordinate production and sales.

A brewery must manage fermentation schedules, monitor tank temperatures, move bottles and cans through filling equipment and palletizers, and then connect finished stock to inventory and delivery planning. Each stage relies on information moving to the next.

When Asahi's order entry and routing systems went down, breweries lost the normal digital view of what to make and where to send it. Phones and fax machines provided a manual substitute for parts of that planning.

Manufacturing has become a major ransomware target in Asia Pacific. A threat intelligence estimate put the sector's share of attacks in the region this year ahead of finance and transportation. Older industrial controllers connected to modern networks, interfaces lacking security updates and outside tools linking factory and corporate systems can create routes for intruders.

An attacker who gains access through one weak point can reach systems used for production, ordering or shipping. When intrusions spread from corporate networks into industrial environments, physical processes can slow or stop alongside the loss of usable files.

Protective measures include separating factory networks from corporate IT, restricting remote access, watching for unusual activity and teaching staff to recognize phishing, deceptive messages designed to obtain access or information. Those measures create barriers between an initial intrusion and the equipment or systems that keep operations running.

Japan strengthens its response to ransomware

Japan's National Police Agency recorded more than 200 ransomware cases in 2024, an increase from the previous year. A survey found that recovery of lost data took at least a month in nearly half of cases.

A law passed in May gave authorities broader powers to disrupt cybercriminals and work with private businesses on prevention and response. The change reflected concern that attacks on computer networks could interrupt services and supplies people use in daily life.

Itsunori Onodera, who chaired a key policy research council during the debate, presented stronger cybersecurity as a public safety issue.

Without an urgent upgrade of the nation's cyber security, the lives of Japanese people will be put at risk.

Recent incidents at major automakers and retailers had already shown how a breach could spread disruption across supplier networks and close plants for days or weeks. Asahi's outage added beverage production and distribution to that picture.

The brewer's response placed business continuity alongside data protection. Restoring secure computer systems mattered, but so did finding ways to accept orders, coordinate factories and get drinks to customers while normal tools were unavailable.

By October 11, paper, phones and fax machines were helping Asahi supply part of the market again. Stores and restaurants continued managing shortages and substitutions, while the company worked on both network recovery and the investigation into stolen information.

Key Points

• A September 29 ransomware attack disrupted Asahi's ordering, shipments and call centers in Japan; international operations were unaffected.
• Employees used handwritten orders, paper forms, phones and fax machines to restart limited deliveries.
• All six domestic beer plants resumed limited production, and soft drink production restarted at selected sites.
• Seven Eleven, Lawson and FamilyMart warned of possible shortages affecting beer, soft drinks and products made for their store brands.
• Marugen Ramen and Kisoji arranged alternatives, including other suppliers and bottled beer.
• Qilin claimed responsibility on October 8 and said it stole roughly 27 gigabytes of data, with one post listing 9,323 files.
• Asahi found stolen data online and was investigating its scope and notification needs.
• Kirin, Sapporo and Suntory supplied replacements where delivery capacity and contracts allowed.
• Japan recorded more than 200 ransomware cases in 2024 and passed a law in May expanding authorities' cyber response powers.
• As of October 11, Asahi had given no estimated date for full system recovery.