AGH
Company Details
Linkedin ID:
asahigroup-holdings
Employees number:
1,129
Number of followers:
202,985
NAICS:
722
Industry Type:
Homepage:
asahigroup-holdings.com
IP Addresses:
0
Company ID:
ASA_1348957
Scan Status:
In-progress
Asahi Group Holdings Company CyberSecurity Posture
asahigroup-holdings.com
Asahi Group Holdings, Ltd. is a global leader offering a diverse collection of brands centered on beer, alcohol and non-alcohol beverages, and food. Our mission is to deliver on our great taste promise and bring more fun to life. Established in Japan in 1889, the Group has always been committed to innovation and quality. This dedication has brought together iconic brands and the expertise of renowned breweries from around the world, including those with a rich heritage spanning over centuries. Our approach has culminated in a globally recognized portfolio of brands that includes premium beers such as Asahi Super Dry, Peroni Nastro Azzurro, Kozel, Pilsner Urquell, and Grolsch. “Make the world shine” articulates Asahi Group’s commitment to build connections among people, thereby paving the way for a sustainable future together. Through these connections, we can contribute to a brighter world, both today and in the future. With a global presence primarily in Japan and East Asia, Europe, Asia Pacific, we provide over 10 billion liters of beverages to consumers worldwide and generate revenues of over JPY 2.9 trillion annually. Headquartered in Japan, Asahi Group Holdings is listed on the Tokyo Stock Exchange (Prime Market: 2502.T). Must be legal drinking age to follow. Please share content with those who are of legal drinking age only.
Asahi Group Holdings A.I CyberSecurity Scoring
AGH Risk Score (AI oriented)Between 0 and 549
AGH
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
AGH Global Score (TPRM)XXXX
AGH
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
AGH Company CyberSecurity News & History
Past Incidents
11
Attack Types
2
Asahi Group Holdings
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Japanese beverage giant **Asahi** suffered a **cyberattack** leading to a **system failure** that severely disrupted its operations in Japan. The incident forced the company to **halt order processing, shipments, and call center services**, crippling customer support and logistics. While Asahi confirmed **no personal or customer data was leaked**, the attack caused **operational paralysis**, affecting its ability to fulfill deliveries and manage business communications. The company, which owns global brands like **Peroni and Grolsch** and operates **30 factories in Japan**, reported over **$9 billion in revenue** for H1 2025. No ransomware group claimed responsibility, and Asahi did not confirm the attack type, but the **prolonged outage**—with no estimated recovery timeline—highlights significant **business continuity risks**. The incident aligns with a rising trend of cyberattacks on beverage manufacturers, with prior ransomware strikes on breweries in Europe and Russia.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Asahi Group Holdings, a major Japanese food and beverage company, suffered a **ransomware attack** claimed by the hacker group **Qilin** on **October 7, 2024**. The attackers allegedly stole **over 9,300 data files**, including **financial records and personal information of employees**. While it remains unclear whether **customer or business partner data** was compromised, the breach forced the company to **postpone its Q1–Q3 earnings release** (originally scheduled for **November 12**) due to system disruptions. The company **confirmed the leaked data’s presence online** the following day, and its systems **remain unrecovered**, forcing manual order processing. The attack’s financial and operational impact includes **delayed reporting, potential reputational damage, and operational inefficiencies**, though the full scope of data exposure—particularly regarding customers—is still under investigation. The involvement of ransomware and theft of **employee personal data** elevates the incident’s severity, with potential long-term consequences for trust and regulatory compliance.
Asahi Group
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Japanese beer maker **Asahi Group** suffered a **ransomware attack** by the **Qilin group**, leading to the exposure of personal data from over **1.5 million individuals**. The attackers infiltrated the company’s network via on-site equipment, deploying ransomware on servers and employee PCs while exfiltrating data. The compromised information likely includes **names, genders, postal addresses, phone numbers, and email addresses** of customers who contacted Asahi’s service centers (affecting ~1.525M people). Additionally, data from **300,000 external contacts, employees, and their family members** may have been exposed. While Asahi confirmed no evidence of data misuse or public leakage, Qilin listed the company on its dark web leak site, indicating a high risk of future exploitation. The attack was contained to Asahi’s Japanese operations, with no confirmed financial or operational disruptions beyond data theft.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi, Japan’s leading brewer with 40% market share, suffered a **ransomware attack** attributed to the Qilin group, forcing it to halt production at most of its 30 factories, including six breweries. The attack crippled its computer systems, reducing operations to manual processes (pen, paper, and fax), severely limiting order processing and shipments. This caused widespread shortages of its products—beer (e.g., Asahi Super Dry), soft drinks, bottled teas, and food items—across convenience stores (FamilyMart, 7-Eleven, Lawson), liquor stores, and restaurants nationwide. Wholesalers reported receiving only **10–20% of normal supply**, with disruptions expected to last at least a month. While European subsidiaries (Peroni, Grolsch, Fuller’s) remained unaffected, the attack exposed Asahi’s **legacy system vulnerabilities** and **data leaks** (suspected stolen data found online). The incident underscored Japan’s broader cybersecurity gaps, including reliance on outdated infrastructure and low digital literacy, prompting government intervention under the new **Active Cyber Defense Law (ACD)**. The financial and reputational damage extends beyond Asahi to retailers, suppliers, and consumers, with no confirmed timeline for full recovery.
Asahi Group Holdings Ltd.
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi Group Holdings Ltd., Japan’s largest brewer, suffered a **ransomware attack** that crippled its internal order and shipment systems, forcing a manual fallback (phone, fax, in-person). Over a month later, operations remain at just **10% capacity**, severely disrupting supply during December—its peak sales month (12% of annual volume from Super Dry alone). The attack caused **stockouts in bars, restaurants, and gift markets**, leading rivals (Kirin, Sapporo, Suntory) to seize market share by replacing Asahi’s dispensing units and glassware. Financial losses include a projected **¥15 billion core operating loss** in Q4, a **13% miss on full-year guidance**, and delayed earnings reports due to inaccessible financial data. The breach exploited vulnerabilities in Asahi’s **fragmented legacy systems** (from acquisitions), compounding recovery challenges. While retail shelves show partial availability, **on-premise sales (bars, izakayas) face long-term loyalty risks**, with some outlets permanently switching brands. The incident also disrupted Japan’s corporate gifting tradition, further damaging revenue and reputation during the critical year-end season.
Asahi Group
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The **Asahi Group**, a Tokyo-based multinational beverage and food company, fell victim to a **ransomware attack** by the **Qilin ransomware group**. The attackers claimed to have exfiltrated **27 GB of sensitive data**, including **personal details of employees**, **financial documents**, **budgets**, **contracts**, **business development plans**, and **forecasts**. The breach caused **significant operational disruptions**, forcing Asahi to **suspend order and shipment operations in Japan**, as well as **shut down call center and customer service desks**. While the company is gradually resuming operations through manual processes, the incident highlights severe **data exposure risks** and **business continuity threats**.The Qilin group, known for its **technically mature RaaS (Ransomware-as-a-Service) model**, has been highly active, accounting for **16% of global ransomware attacks in August 2025**. This attack follows a pattern of targeting Japanese firms, with Asahi being the latest high-profile victim. The stolen data includes **both internal employee records and critical business intelligence**, raising concerns over **long-term financial, reputational, and competitive damage**. Asahi has not publicly confirmed or denied the ransom demands, but the operational halt underscores the **severe impact on core business functions**.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: In September 2025, Japan’s largest brewery, **Asahi Group Holdings**, fell victim to a **Qilin ransomware attack** that crippled its entire digital infrastructure over a weekend. By Monday, all **30 factories shut down**, halting production of flagship products like **Super Dry beer**. The attack locked every computer system, forcing employees to revert to **manual processes**—taking orders by phone, handwriting shipment instructions, and relying on **fax machines** to communicate with warehouses and distributors. Analysts projected an **83% domestic profit loss** if the outage persisted. While six breweries gradually restarted in early October, many systems remained unrecovered weeks later, with operations running primarily on **paper and fax**. The incident exposed critical vulnerabilities in digital dependency, as the company spent weeks rebuilding IT infrastructure from scratch while struggling to meet market demand and avoid reputational damage.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi Group Holdings, a major Japanese beer and beverage company, suffered a ransomware attack by the Qilin group, disrupting production across its six beer plants in Japan. The attack, first disclosed on **September 29**, forced a temporary halt in operations, with production resuming only on **October 2**. Qilin claimed responsibility on **October 1**, publishing **29 images** of allegedly stolen internal documents and asserting the theft of **over 9,300 files (27 GB)** of data. The group operates a **ransomware-as-a-service (RaaS)** model, extorting victims for financial gain. The incident remains under investigation, with Asahi declining to confirm the authenticity of the leaked data, extortion demands, or negotiations. Qilin, active since **2022**, has a history of high-profile attacks, including the **June 2024 breach of Synnovis**, a UK diagnostic services provider, which indirectly contributed to a patient’s death in **2025**. The Asahi attack highlights the growing threat of ransomware disrupting critical industrial operations, risking financial losses, reputational damage, and operational downtime.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi Group Holdings, the Japanese beverage giant and producer of **Asahi Super Dry**, suffered a **ransomware attack** in late September 2024, disrupting its operations. The attack forced the company to **delay the release of its full-year financial results** (fiscal year ending December 2025) due to ongoing system recovery efforts. While **shipments are gradually resuming**, the incident caused **operational disruptions**, including potential delays in production and distribution. The attack was claimed by the **Qilin hacker group**, allegedly based in Russia, though Asahi has not confirmed the perpetrator’s identity or ransom demands. The incident highlights the growing threat of ransomware against high-profile corporations, with Asahi joining other global victims like **Jaguar Land Rover** (factory halts) and **Muji** (online service shutdowns). The financial and reputational impact remains significant, as the company works to restore systems while managing public trust and supply chain stability.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi Group Holdings, the maker of **Asahi Super Dry**, suffered a **sophisticated ransomware attack** in late September 2023, attributed to the Russian-linked hacker group **Qilin**. The attack disrupted operations for nearly **three months**, forcing the company to **delay financial disclosures** (third-quarter and full-year earnings) and **halt production** across its 30 domestic factories due to system-wide shutdowns. While six beer factories later resumed operations, order processing reverted to manual methods to avoid shortages. The breach caused **supply chain disruptions**, with shipments resuming gradually as systems were restored. Japanese media reported full recovery would take until **February 2024**. The CEO emphasized the attack was **beyond their cybersecurity measures**, describing it as 'cunning' and refusing ransom negotiations. The incident highlights Japan’s broader vulnerability to cyber threats, with a recent survey revealing **one-third of Japanese businesses** experienced attacks in 2023.
Asahi Group Holdings Ltd.
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi Group Holdings Ltd., Japan’s largest beer brewer, suffered a ransomware attack by the Russian-speaking hacker group Qilin, which disrupted operations for over a week. The attack led to the theft of approximately **27 GB of data**, including **financial documents, contracts, development forecasts, and employees’ personal information**. The breach forced Asahi to **halt production at nearly 30 domestic factories**, crippling distribution and limiting orders to only its flagship *Asahi Super Dry* brew. While plants were gradually restored by mid-October, output remained below normal capacity. The stolen data was later found leaked online, though Asahi declined to confirm specifics. The incident caused supply chain disruptions, prompting competitors like Kirin, Sapporo, and Suntory to ramp up production to meet market demand. Qilin, known for **double-extortion tactics** (encrypting files and threatening to publish stolen data), has previously targeted over 100 companies globally, including a **$50M ransomware attack on UK hospital lab provider Synnovis** in 2024. The attack underscored Japan’s vulnerability to cyber threats, with ripple effects across factories, retailers, and restaurants.
AGH Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for AGH
Incidents vs Food and Beverage Services Industry Average (This Year)
Asahi Group Holdings has 745.07% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Asahi Group Holdings has 669.23% more incidents than the average of all companies with at least one recorded incident.
Incident Types AGH vs Food and Beverage Services Industry Avg (This Year)
Asahi Group Holdings reported 6 incidents this year: 1 cyber attacks, 5 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — AGH (X = Date, Y = Severity)
AGH cyber incidents detection timeline including parent company and subsidiaries
AGH Company Subsidiaries
Asahi Group Holdings, Ltd. is a global leader offering a diverse collection of brands centered on beer, alcohol and non-alcohol beverages, and food. Our mission is to deliver on our great taste promise and bring more fun to life. Established in Japan in 1889, the Group has always been committed to innovation and quality. This dedication has brought together iconic brands and the expertise of renowned breweries from around the world, including those with a rich heritage spanning over centuries. Our approach has culminated in a globally recognized portfolio of brands that includes premium beers such as Asahi Super Dry, Peroni Nastro Azzurro, Kozel, Pilsner Urquell, and Grolsch. “Make the world shine” articulates Asahi Group’s commitment to build connections among people, thereby paving the way for a sustainable future together. Through these connections, we can contribute to a brighter world, both today and in the future. With a global presence primarily in Japan and East Asia, Europe, Asia Pacific, we provide over 10 billion liters of beverages to consumers worldwide and generate revenues of over JPY 2.9 trillion annually. Headquartered in Japan, Asahi Group Holdings is listed on the Tokyo Stock Exchange (Prime Market: 2502.T). Must be legal drinking age to follow. Please share content with those who are of legal drinking age only.
Loading...
AGH Similar Companies
Red Bull
Red Bull Gives Wiiings to People and Ideas. This has driven us – and all we do – since 1987. Today, Red Bull operates in over 170 countries, selling more than 12 billion cans annually and growing! Above all, our people remain the essential ingredient in bringing the Red Bull brand to life. Check out
Compass Group PLC is a world leading food and support services company, which serves meals to millions of people in c.30 countries and employs and engages more than 580,000 people globally. The Company specialises in providing food and a range of support services across the core sectors of Business
Carlsberg Group
This is the official LinkedIn channel of the Carlsberg Group. The Carlsberg Group was established in 1847 by brewer J.C. Jacobsen. J.C. Jacobsen was a true renaissance man. A believer in quality, research and serving the community, he shared his knowledge with fellow brewers. He looked to the futur
Sysco
Sysco is the global leader in selling, marketing and distributing food products to restaurants, healthcare and educational facilities, lodging establishments and other customers who prepare meals away from home. Its family of products also includes equipment and supplies for the foodservice and hosp
PepsiCo is a playground for curious people. We invite thinkers, doers, and changemakers to champion innovation, take calculated risks, and challenge the status quo. From executives to team members on the front lines, we’re excited about the future. We take chances. Together, we dare to make the worl
Greene King
Greene King is the country’s leading pub company and brewer with c.2,600 pubs, restaurants and hotels across England, Wales and Scotland. At Greene King we are passionate about delivering our purpose to ‘pour happiness into lives’. That’s for our customers, our team, our pub partners, our suppliers
Grupo Bimbo
Grupo Bimbo es la empresa líder en panificación y un jugador relevante en snacks. Hornea +9,000 productos, distribuyéndolos a través de +3.5 millones de puntos de venta con +58,000 rutas. Grupo Bimbo tiene +149,000 colaboradores, +1,500 centros de ventas estratégicamente localizados en 35 países d
Krispy Kreme
Headquartered in Charlotte, N.C., Krispy Kreme is one of the most beloved and well-known sweet treat brands in the world. Our iconic Original Glazed® doughnut is universally recognized for its hot-off-the-line, melt-in-your-mouth experience. Krispy Kreme operates in more than 40 countries through it
Every day, millions of people throughout the world consume foods and beverages containing Kerry’s taste and nutrition solutions. We are committed to making the world of food and beverage better for everyone, and dedicated to our Purpose, Inspiring Food, Nourishing Life. At Kerry, we are proud to
.png)
AGH CyberSecurity News
December 02, 2025 10:07 PM
News - Asahi Discloses September Data Incident Affecting Almost 2 Million People
Japanese brewing and beverage company Asahi Group Holdings said the data security incident it suffered in September compromised the...
November 29, 2025 03:17 PM
Japanese beer giant Asahi says data breach hit 1.5 million people
Asahi Group Holdings, Japan's largest beer producer, has finished the investigation into the September cyberattack and found that the...
November 28, 2025 02:47 PM
Asahi Confirms Massive Data Breach Following September Ransomware Attack
Asahi confirms ransomware attack exposed data of 2 million customers and employees, disrupting Japan operations and delaying financial...
November 28, 2025 09:28 AM
Asahi Confirms Cyberattack Exposed Data of 1.5M Customers
The incident occurred in September, and the Japanese firm has now released its full internal investigation results.
November 28, 2025 07:12 AM
Japan's Asahi Group says ransomware attack 'sophisticated, exceeded expectations'
Asahi Group Holdings in its first press conference since the debilitating September ransomware attacks defended its existing systems as...
November 27, 2025 05:28 PM
Asahi Cyberattack: Qilin Ransomware Gang Claims Massive Data Breach at Japanese Beer Giant
Japan's largest brewery is reeling after an Asahi Cyberattack linked to the ransomware gang Qilin, exposing sensitive data affecting more...
November 27, 2025 12:21 PM
Asahi says Qilin ransomware attack exposed data of 1.5 million people
Asahi Group Holdings has confirmed that a ransomware attack, which disrupted its operations in late September, led to the exposure of...
November 27, 2025 11:00 AM
Data linked to 2 million people feared leaked in cyber attack, says beverage giant Asahi
TOKYO – Japanese beverage giant Asahi Group Holdings said on Nov 27 an investigation has found that personal information linked to around two million...
November 27, 2025 08:00 AM
Asahi cyber attack spirals into massive data breach impacting almost 2 million people
Asahi Group Holdings, the makers of the popular Japanese beer Asahi Super Dry, has confirmed that the ransomware attack that disrupted its...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
AGH CyberSecurity History Information
Official Website of Asahi Group Holdings
The official website of Asahi Group Holdings is https://www.asahigroup-holdings.com/en/.
Asahi Group Holdings’s AI-Generated Cybersecurity Score
According to Rankiteo, Asahi Group Holdings’s AI-generated cybersecurity score is 100, reflecting their Critical security posture.
How many security badges does Asahi Group Holdings’ have ?
According to Rankiteo, Asahi Group Holdings currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Asahi Group Holdings have SOC 2 Type 1 certification ?
According to Rankiteo, Asahi Group Holdings is not certified under SOC 2 Type 1.
Does Asahi Group Holdings have SOC 2 Type 2 certification ?
According to Rankiteo, Asahi Group Holdings does not hold a SOC 2 Type 2 certification.
Does Asahi Group Holdings comply with GDPR ?
According to Rankiteo, Asahi Group Holdings is not listed as GDPR compliant.
Does Asahi Group Holdings have PCI DSS certification ?
According to Rankiteo, Asahi Group Holdings does not currently maintain PCI DSS compliance.
Does Asahi Group Holdings comply with HIPAA ?
According to Rankiteo, Asahi Group Holdings is not compliant with HIPAA regulations.
Does Asahi Group Holdings have ISO 27001 certification ?
According to Rankiteo,Asahi Group Holdings is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Asahi Group Holdings
Asahi Group Holdings operates primarily in the Food and Beverage Services industry.
Number of Employees at Asahi Group Holdings
Asahi Group Holdings employs approximately 1,129 people worldwide.
Subsidiaries Owned by Asahi Group Holdings
Asahi Group Holdings presently has no subsidiaries across any sectors.
Asahi Group Holdings’s LinkedIn Followers
Asahi Group Holdings’s official LinkedIn profile has approximately 202,985 followers.
NAICS Classification of Asahi Group Holdings
Asahi Group Holdings is classified under the NAICS code 722, which corresponds to Food Services and Drinking Places.
Asahi Group Holdings’s Presence on Crunchbase
No, Asahi Group Holdings does not have a profile on Crunchbase.
Asahi Group Holdings’s Presence on LinkedIn
Yes, Asahi Group Holdings maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/asahigroup-holdings.
Cybersecurity Incidents Involving Asahi Group Holdings
As of December 11, 2025, Rankiteo reports that Asahi Group Holdings has experienced 11 cybersecurity incidents.
Number of Peer and Competitor Companies
Asahi Group Holdings has an estimated 8,495 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Asahi Group Holdings ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Ransomware.
What was the total financial impact of these incidents on Asahi Group Holdings ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $15 billion.
How does Asahi Group Holdings detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (investigation underway), and remediation measures with working to restore operations, and communication strategy with public statement issued (apology to customers/partners), and incident response plan activated with yes (manual order and shipping processes initiated), and recovery measures with manual order and shipping processes, and incident response plan activated with yes (under investigation), and remediation measures with restarted production at affected plants, and communication strategy with public disclosure via spokesperson statement, communication strategy with declined to comment on extortion details, and incident response plan activated with yes (it teams engaged in system rebuild), and containment measures with isolation of infected systems, containment measures with disconnection of digital networks, and remediation measures with manual order processing (fax/paper), remediation measures with in-person order collection, remediation measures with gradual system restoration, and recovery measures with rebuilding digital infrastructure from scratch, recovery measures with partial restart of 6 breweries by early october 2025, and communication strategy with public disclosure via media (e.g., the japan times), communication strategy with customer advisories on potential shortages, and incident response plan activated with yes (partial recovery ongoing), and containment measures with isolation of affected systems, containment measures with manual order processing, and remediation measures with system restoration from backups (assumed), and recovery measures with gradual resumption of production (by 2024-10-10), recovery measures with prioritization of key products (asahi super dry), recovery measures with expanded shipments from 2024-10-15, and communication strategy with public statement on 2024-10-09 (wednesday), communication strategy with spokesperson updates, communication strategy with no details on ransom negotiations, and and and containment measures with partial reopening of factories, containment measures with isolation of affected systems (likely), and remediation measures with manual order processing via pen/paper/fax, remediation measures with gradual restoration of it systems, and recovery measures with prioritizing shipments to larger customers, recovery measures with limited production resumption, and communication strategy with public apology for disruptions, communication strategy with updates via media (no direct timeline provided), and recovery measures with manual order processing (temporary workaround), and incident response plan activated with yes (manual processing implemented), and containment measures with reversion to manual order processing (phone, fax, in-person), and and containment measures with system isolation, containment measures with restoration efforts, and remediation measures with system recovery in progress, and recovery measures with phased resumption of product shipments, and communication strategy with public statement by ceo atsushi katsuki, communication strategy with apology for inconvenience, and and communication strategy with public announcement on company website, and and containment measures with isolation of affected systems, containment measures with manual order processing to mitigate supply chain disruptions, and remediation measures with system restoration (ongoing as of december 2023), remediation measures with gradual resumption of production, and recovery measures with expected full system recovery by february 2024, and communication strategy with public press conference by ceo atsushi katsuki, communication strategy with delayed financial disclosures with promises of transparency post-recovery, communication strategy with apologies to customers for inconvenience..
Incident Details
Can you provide details on each incident ?
Title: Cyberattack Disrupts Asahi's Order and Shipment Operations in Japan
Description: Japanese beverage company Asahi experienced a cyberattack causing a system failure that disrupted its ability to ship orders and manage its call center. The incident affected operations in Japan, including order and shipment processes, call center operations, and some customer service desks. Asahi reported no confirmed leakage of personal or customer data. The company is investigating the cause and working to restore operations, with no estimated recovery timeline. The attack is limited to Asahi's operations within Japan. No ransomware claim or attribution has been made as of the report.
Date Publicly Disclosed: 2025-MM-DD (exact date not specified; statement published on a Monday)
Type: Cyberattack (potential ransomware, unconfirmed)
Title: Qilin Ransomware Attack on Asahi Group
Description: The Qilin ransomware group claimed responsibility for a cyber-attack on Japan’s Asahi Group, alleging the theft of 27 GB of sensitive data, including employee personal details, financial documents, budgets, contracts, plans, and development forecasts. The attack caused significant operational disruption, including the suspension of order and shipment operations, as well as call center services in Japan. Asahi is in the process of resuming operations with manual processes.
Date Publicly Disclosed: 2025-10-07
Type: ransomware
Threat Actor: Qilin ransomware group
Motivation: financial gain (ransomware-as-a-service)
Title: Qilin Ransomware Attack on Asahi Group Holdings Disrupts Beer Production
Description: Qilin, a ransomware group, claimed responsibility for a cyberattack on Japan's Asahi Group Holdings, disrupting production at its beer and beverage plants. The group posted 29 images of allegedly stolen internal documents and claimed to have exfiltrated over 9,300 files (27 GB). Asahi Breweries restarted production at its six Japanese beer plants on October 2, 2024, after the attack was first disclosed on September 29, 2024. The incident remains under investigation, with no confirmed details on extortion demands or negotiations.
Date Detected: 2024-09-29
Date Publicly Disclosed: 2024-09-29
Date Resolved: 2024-10-02
Type: ransomware
Threat Actor: Qilin (Ransomware-as-a-Service group)
Motivation: financial gainextortion
Title: Qilin Ransomware Attack on Asahi Group Holdings (2025)
Description: In September 2025, Japan's largest brewery, Asahi Group Holdings, was crippled by a ransomware attack from the Qilin group. The attack locked all computer systems, shutting down 30 factories and forcing the company to revert to manual processes, including fax machines and paper orders, for weeks. The incident caused significant operational disruptions, with an estimated 83% domestic profit hit if the outage persisted. Asahi gradually restored six breweries by early October, but many systems remained unrecovered. The attack highlighted the unintended resilience of analog systems like fax machines, which remained operational due to their separation from compromised digital networks.
Date Detected: 2025-09-01T00:00:00Z
Date Publicly Disclosed: 2025-10-04T00:00:00Z
Type: Ransomware
Attack Vector: Malicious File Download (likely phishing or compromised link)Network Encryption
Threat Actor: Qilin Ransomware Group
Motivation: Financial Gain (Ransom Demand)
Title: Ransomware Attack on Asahi Group Holdings Ltd. by Qilin Hacking Group
Description: A Russian-speaking hacker group known as Qilin claimed responsibility for a ransomware attack on Asahi Group Holdings Ltd., Japan's largest beer brewer. The attack disrupted operations for over a week, leading to production halts at roughly 30 domestic factories. The group stole approximately 27 GB of data, including financial documents, contracts, development forecasts, and employees' personal information. Asahi confirmed leaked information was found online but did not disclose further investigation details. Production is expected to resume partially by October 10 (Thursday), though output will remain below normal. Rival breweries (Kirin, Sapporo, Suntory) are compensating for shortages, with Suntory canceling limited-edition beer launches to prioritize mainstay products. Qilin, active since mid-2022, employs double-extortion tactics (encryption + data theft) and has targeted over 100 companies globally, including a $50M attack on UK's Synnovis in 2024.
Date Detected: 2024-09-29
Date Publicly Disclosed: 2024-09-29
Type: ransomware
Attack Vector: phishingexploiting vulnerabilitiesmalware deployment
Threat Actor: Qilin (Russian-speaking hacker group)
Motivation: financial gainextortion
Title: Cyber-Attack on Asahi Group Forcing Manual Operations and Supply Chain Disruptions
Description: Asahi Group, Japan's largest brewer and maker of Asahi Super Dry, suffered a cyber-attack in late May 2024 that disrupted production at 30 factories, including six breweries. The attack forced the company to revert to manual processes (pen, paper, and fax) for order processing and shipments, causing widespread shortages of beer, soft drinks, and other products across Japan. The ransomware group Qilin claimed responsibility, and Asahi confirmed data suspected to have been leaked was found online. Operations have partially resumed, but full recovery timelines remain unclear. The incident highlights Japan's vulnerability to cyber-attacks due to reliance on legacy systems and low digital literacy in business software.
Date Detected: Late May 2024
Date Publicly Disclosed: Early June 2024
Type: Ransomware Attack
Attack Vector: Phishing (suspected)Exploitation of Legacy SystemsRansomware-as-a-Service (RaaS)
Vulnerability Exploited: Legacy IT SystemsLow Digital Literacy in Business SoftwareLack of Cybersecurity Preparedness
Threat Actor: Qilin Ransomware Group
Motivation: Financial Gain (Extortion)
Title: Cyberattack and Potential Data Breach at Asahi Group Holdings
Description: Asahi Group Holdings, a Japanese food and beverage company, experienced a ransomware attack in October 2023. The hacker group Qilin claimed responsibility, stating it stole over 9,300 data files, including financial data and employee personal information. The attack disrupted operations, delaying earnings reports and forcing manual order processing. The company confirmed the potential breach of personal data on October 8, 2023.
Date Publicly Disclosed: 2023-10-08
Type: ransomware
Threat Actor: Qilin
Title: Cyberattack Cripples Asahi Group Holdings Ltd., Disrupting Supply Chain and Market Position
Description: A ransomware attack on Asahi Group Holdings Ltd. disabled its internal order and shipment system, forcing the company to revert to manual processing (in-person, phone, fax). The attack occurred during Japan's peak beer-drinking season (December), reducing shipments to 10% of normal levels. Competitors like Kirin, Suntory, and Sapporo capitalized on the disruption, replacing Asahi's dispensing units and gaining market share. The incident exposed vulnerabilities in Asahi's legacy systems, which were undergoing integration at the time. Financial losses include a projected ¥15 billion core operating loss for Q4, with full-year guidance expected to miss by 13%. The attack also disrupted gift pack sales, a key Japanese custom, and delayed Q3 earnings reporting indefinitely.
Date Publicly Disclosed: 2023-10-06
Type: Ransomware Attack
Vulnerability Exploited: Legacy system integration vulnerabilities during platform consolidation
Title: Ransomware Attack on Asahi Group Holdings
Description: Japanese beer giant Asahi Group Holdings, maker of Asahi Super Dry, was hit by a ransomware attack in late September 2025. The attack disrupted operations, delayed the release of full-year financial results, and caused partial shipment halts. The company is working to restore systems, with shipments resuming in stages. The hacker group Qilin, believed to be based in Russia, is suspected to be responsible.
Date Detected: 2025-09-29
Date Publicly Disclosed: 2025-09-29
Type: ransomware
Threat Actor: Qilin (suspected, Russia-based)
Motivation: financial (ransomware)
Title: Asahi Ransomware Attack Exposing Data of Over 1.5 Million Individuals
Description: Japanese beer maker Asahi was struck by a ransomware attack, with attackers accessing servers and PCs, stealing personal information from customer service contacts. The Qilin ransomware group claimed responsibility, adding Asahi to its dark web leak site. Approximately 1.525 million customer records and 300,000 additional records (external contacts, employees, and family members) may have been exposed, including names, gender data, postal addresses, phone numbers, and email addresses.
Date Detected: 2023-09-29
Type: Ransomware Attack
Attack Vector: Equipment located at Asahi Group’s site
Threat Actor: Qilin Ransomware Group
Motivation: Financial (likely ransom demand)
Title: Ransomware Attack on Asahi Group Holdings
Description: Japanese beer giant Asahi Group Holdings, maker of Asahi Super Dry, was hit by a sophisticated ransomware attack in late September 2023. The attack, attributed to the Russian-based hacker group Qilin, disrupted operations for nearly three months, delaying financial reporting and causing production halts. Asahi refused to negotiate or pay any ransom, opting instead to restore systems manually. The incident highlights broader cybersecurity vulnerabilities among Japanese corporations, with experts noting a cultural reluctance to prioritize cybersecurity investments.
Date Detected: 2023-09-29
Date Publicly Disclosed: 2023-09-29
Type: Ransomware Attack
Threat Actor: Qilin (suspected Russian-based hacker group)
Motivation: Financial (ransomware extortion)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Ransomware.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Equipment located at Asahi Group’s site.
Impact of the Incidents
What was the impact of each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Data Compromised: None confirmed (as per Asahi's statement)
Systems Affected: Order and shipment systems (group companies in Japan)Call center operationsCustomer service desks
Downtime: Ongoing (no estimated recovery timeline)
Operational Impact: Suspended order/shipment operations, disrupted call center and customer service
Brand Reputation Impact: Potential negative impact due to service disruption (apology issued)
Identity Theft Risk: None confirmed
Payment Information Risk: None confirmed
Incident : ransomware ASA2592025100725
Data Compromised: Employee personal details, Financial documents, Budgets, Contracts, Plans, Development forecasts
Systems Affected: serversorder and shipment systemscall center operations
Downtime: ongoing (partial recovery with manual processes)
Operational Impact: suspended order and shipment operationssuspended call center operations (customer service desks)
Brand Reputation Impact: potential negative impact due to data breach and operational disruption
Identity Theft Risk: high (employee personal details compromised)
Incident : ransomware ASA1362013100825
Data Compromised: Type: [, ', i, n, t, e, r, n, a, l, , d, o, c, u, m, e, n, t, s, ', ,, , ', c, o, r, p, o, r, a, t, e, , d, a, t, a, ', ], Volume: 2, 7, , G, B, , (, 9, ,, 3, 0, 0, +, , f, i, l, e, s, ),
Systems Affected: beer production plants (6 locations in Japan)
Downtime: 3 days (from 2024-09-29 to 2024-10-02)
Operational Impact: production halt at all six Japanese beer plants
Brand Reputation Impact: potential reputational damage due to public disclosure and operational disruption
Incident : Ransomware ASA3192031100825
Systems Affected: All computer systems30 factoriesDigital order processingSupply chain management
Downtime: ['Weeks (partial recovery by early October 2025)', '37+ days for full system restoration (estimated)']
Operational Impact: Complete shutdown of digital operationsManual order processing (paper/fax)In-person order collectionGradual restart of 6 breweries by early October83% potential domestic profit loss if outage continued
Customer Complaints: ['Potential Super Dry beer shortages reported by convenience stores']
Brand Reputation Impact: High (publicized operational collapse)Media coverage of analog fallback (fax/paper)
Incident : ransomware ASA2492424100825
Data Compromised: Financial documents, Contracts, Development forecasts, Employees' personal information
Systems Affected: production systemsdistribution networksorder processing
Downtime: >1 week (production halt at ~30 factories)
Operational Impact: manual order processing (phone-based)limited product shipments (only Asahi Super Dry initially)reduced output post-recoverysupply chain disruptions
Brand Reputation Impact: Potential damage due to production delays and data leak
Identity Theft Risk: High (employees' personal information exposed)
Incident : Ransomware Attack ASA2162021101125
Systems Affected: Production Systems (30 factories, including 6 breweries)Order Processing SystemsShipment Logistics SystemsCommunication Systems (reverted to fax)
Downtime: ['Partial downtime ongoing as of early June 2024', 'Full recovery timeline unspecified']
Operational Impact: Manual processing of orders via pen/paper/faxReduced shipment capacity (10-20% of normal)Production halts at most facilitiesSupply chain disruptions for beer, soft drinks, and food items
Customer Complaints: True
Brand Reputation Impact: Short-term reputational damage due to product shortagesErosion of trust in digital resilience
Incident : ransomware ASA2392123101525
Downtime: True
Operational Impact: Manual order processing; delayed earnings release (postponed from November 12, 2023)
Identity Theft Risk: Potential (employee personal information compromised)
Incident : Ransomware Attack ASA3932439111225
Financial Loss: Projected ¥15 billion core operating loss for Q4; full-year guidance expected to miss by 13%; higher marketing costs to win back customers
Systems Affected: Order and shipment processing systemFinancial data accessSupply chain operations
Downtime: Over one month (as of report date, ongoing)
Operational Impact: Shipments reduced to 10% of normal; manual processing (phone, fax, in-person) implemented; delayed Q3 earnings report; disrupted gift pack sales
Revenue Loss: Super Dry alone accounts for 12% of annual sales volume; December is strongest month
Customer Complaints: Bars and restaurants reported stockouts (e.g., Bier Reise ’98, Izakaya Ueno Ichiba Honten); gift pack shortages
Brand Reputation Impact: Lost No. 1 retail market position to Kirin; risk of long-term loyalty loss as competitors replace dispensing units and glassware
Incident : ransomware ASA5662456112725
Systems Affected: financial reporting systemssupply chain/logistics systems
Downtime: ongoing (as of disclosure, partial recovery in progress)
Operational Impact: delayed financial results, disrupted product shipments (resuming in stages)
Brand Reputation Impact: potential negative impact due to operational disruption
Incident : Ransomware Attack ASA4832448112725
Systems Affected: Servers in the data centerCompany-issued PCs
Operational Impact: Limited to systems managed in Japan
Brand Reputation Impact: Potential reputational damage due to data exposure of 1.825 million individuals
Identity Theft Risk: High (personal data of 1.825 million individuals exposed)
Incident : Ransomware Attack ASA4032640112725
Systems Affected: Corporate IT systemsFinancial reporting systemsOrder processing systems
Downtime: Approximately 3 months (as of December 2023, with full recovery expected by February 2024)
Operational Impact: Production halts at 30 domestic factories (temporarily resumed at 6 beer factories via manual order processing)Delayed third-quarter and full-year financial resultsDisruption to supply chain and product shipments
Brand Reputation Impact: Moderate (public acknowledgment of attack, delayed financial reporting, and operational disruptions)
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $1.36 billion.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are None confirmed, Personal Details (Employees), Financial Documents, Budgets, Contracts, Plans, Development Forecasts, , Internal Documents, Corporate Files, , Financial Records, Contracts, Business Forecasts, Pii (Employees), , Corporate Data (Suspected), Potentially Customer/Partner Data (Unconfirmed), , Financial Data, Employee Personal Information, , Names, Gender Data, Postal Addresses, Phone Numbers, Email Addresses and .
Which entities were affected by each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Public Company
Industry: Beverage (Alcoholic & Non-Alcoholic)
Location: Japan
Size: Large (30+ factories in Japan, $9B+ revenue in H1 2025)
Incident : ransomware ASA2592025100725
Entity Name: Asahi Group
Entity Type: corporation
Industry: beverage (alcoholic and non-alcoholic), food products
Location: Tokyo, Japan
Size: large (global brands: Asahi, Peroni, Kozer, Pilsner Urquell, Grolsch, Fullers)
Incident : ransomware ASA1362013100825
Entity Name: Asahi Group Holdings
Entity Type: public company
Industry: beverage (beer and non-alcoholic drinks)
Location: Japan
Size: large enterprise
Incident : Ransomware ASA3192031100825
Entity Name: Asahi Group Holdings
Entity Type: Public Company
Industry: Beverage, Brewery, Food & Beverage
Location: Japan (HQ in Tokyo)Global operations
Size: Large (30+ factories, multinational)
Customers Affected: Retailers (e.g., convenience stores), Distributors, End consumers (potential beer shortages)
Incident : ransomware ASA2492424100825
Entity Name: Asahi Group Holdings Ltd.
Entity Type: Public Company
Industry: Beverage, Brewery, Food & Beverage
Location: Tokyo, Japan
Size: Large (global operations)
Customers Affected: retailers, restaurants, consumers (indirectly via shortages)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Public Company (Brewing & Beverages)
Industry: Food & Beverage, Alcohol, Consumer Goods
Location: Japan (primary impact; European subsidiaries unaffected)
Size: Large (40% market share in Japan's beer industry)
Customers Affected: Bars, Restaurants, Retailers, Convenience Stores (FamilyMart, 7-Eleven, Lawson), Wholesalers, End Consumers
Incident : Ransomware Attack ASA2162021101125
Entity Name: FamilyMart
Entity Type: Convenience Store Chain
Industry: Retail
Location: Japan
Size: Large
Customers Affected: Consumers (shortages of Famimaru bottled teas)
Incident : Ransomware Attack ASA2162021101125
Entity Name: 7-Eleven Japan
Entity Type: Convenience Store Chain
Industry: Retail
Location: Japan
Size: Large
Customers Affected: Consumers (halted shipments of Asahi products)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Lawson, Inc.
Entity Type: Convenience Store Chain
Industry: Retail
Location: Japan
Size: Large
Customers Affected: Consumers (expected shortages of Asahi products)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Ben Thai Restaurant (Sengawacho, Tokyo)
Entity Type: Small Business (Restaurant)
Industry: Hospitality
Location: Tokyo, Japan
Size: Small
Customers Affected: Dine-in customers (limited beer availability)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Hisako Arisawa's Liquor Store
Entity Type: Small Business (Retail)
Industry: Alcohol Sales
Location: Tokyo, Japan
Size: Small
Customers Affected: Consumers (limited stock of Asahi Super Dry and soft drinks)
Incident : ransomware ASA2392123101525
Entity Name: Asahi Group Holdings
Entity Type: Corporation
Industry: Food and Beverage
Location: Japan
Incident : Ransomware Attack ASA3932439111225
Entity Name: Asahi Group Holdings Ltd.
Entity Type: Public Company
Industry: Beverage (Brewery)
Location: Japan
Size: Large (46% of total revenue from Japan in 2023)
Customers Affected: Bars, restaurants, retailers, wholesalers, and end consumers (e.g., Bier Reise ’98, Izakaya Ueno Ichiba Honten, OK Corp., Seven & i Holdings, FamilyMart, Lawson, Isetan Mitsukoshi, Takashiyama)
Incident : Ransomware Attack ASA3932439111225
Entity Name: Bier Reise ’98
Entity Type: Bar
Industry: Hospitality
Location: Shimbashi, Tokyo, Japan
Size: Small Business
Customers Affected: Patrons (80% of sales previously from Asahi Maruefu)
Incident : Ransomware Attack ASA3932439111225
Entity Name: Izakaya Ueno Ichiba Honten
Entity Type: Restaurant
Industry: Hospitality
Location: Ueno, Tokyo, Japan
Size: Small/Medium Business
Incident : ransomware ASA5662456112725
Entity Name: Asahi Group Holdings
Entity Type: public company
Industry: beverage (alcohol/beer)
Location: Japan
Size: large enterprise
Incident : Ransomware Attack ASA4832448112725
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Corporation
Industry: Beverage (Beer, Soft Drinks, Food)
Location: Japan
Customers Affected: 1,825,000 (1,525,000 customers + 300,000 external contacts/employees/family members)
Incident : Ransomware Attack ASA4832448112725
Entity Name: Asahi Breweries
Entity Type: Subsidiary
Industry: Beverage (Beer)
Location: Japan
Incident : Ransomware Attack ASA4832448112725
Entity Name: Asahi Soft Drinks
Entity Type: Subsidiary
Industry: Beverage (Soft Drinks)
Location: Japan
Incident : Ransomware Attack ASA4832448112725
Entity Name: Asahi Group Foods
Entity Type: Subsidiary
Industry: Food
Location: Japan
Incident : Ransomware Attack ASA4032640112725
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Public Company
Industry: Beverage (Brewery)
Location: Japan
Size: Large (global corporation)
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Incident Response Plan Activated: Yes (investigation underway)
Remediation Measures: Working to restore operations
Communication Strategy: Public statement issued (apology to customers/partners)
Incident : ransomware ASA2592025100725
Incident Response Plan Activated: yes (manual order and shipping processes initiated)
Recovery Measures: manual order and shipping processes
Incident : ransomware ASA1362013100825
Incident Response Plan Activated: yes (under investigation)
Remediation Measures: restarted production at affected plants
Communication Strategy: public disclosure via spokesperson statementdeclined to comment on extortion details
Incident : Ransomware ASA3192031100825
Incident Response Plan Activated: Yes (IT teams engaged in system rebuild)
Containment Measures: Isolation of infected systemsDisconnection of digital networks
Remediation Measures: Manual order processing (fax/paper)In-person order collectionGradual system restoration
Recovery Measures: Rebuilding digital infrastructure from scratchPartial restart of 6 breweries by early October 2025
Communication Strategy: Public disclosure via media (e.g., The Japan Times)Customer advisories on potential shortages
Incident : ransomware ASA2492424100825
Incident Response Plan Activated: Yes (partial recovery ongoing)
Containment Measures: isolation of affected systemsmanual order processing
Remediation Measures: system restoration from backups (assumed)
Recovery Measures: gradual resumption of production (by 2024-10-10)prioritization of key products (Asahi Super Dry)expanded shipments from 2024-10-15
Communication Strategy: public statement on 2024-10-09 (Wednesday)spokesperson updatesno details on ransom negotiations
Incident : Ransomware Attack ASA2162021101125
Incident Response Plan Activated: True
Containment Measures: Partial reopening of factoriesIsolation of affected systems (likely)
Remediation Measures: Manual order processing via pen/paper/faxGradual restoration of IT systems
Recovery Measures: Prioritizing shipments to larger customersLimited production resumption
Communication Strategy: Public apology for disruptionsUpdates via media (no direct timeline provided)
Incident : ransomware ASA2392123101525
Recovery Measures: Manual order processing (temporary workaround)
Incident : Ransomware Attack ASA3932439111225
Incident Response Plan Activated: Yes (manual processing implemented)
Containment Measures: Reversion to manual order processing (phone, fax, in-person)
Incident : ransomware ASA5662456112725
Incident Response Plan Activated: True
Containment Measures: system isolationrestoration efforts
Remediation Measures: system recovery in progress
Recovery Measures: phased resumption of product shipments
Communication Strategy: public statement by CEO Atsushi Katsukiapology for inconvenience
Incident : Ransomware Attack ASA4832448112725
Incident Response Plan Activated: True
Communication Strategy: Public announcement on company website
Incident : Ransomware Attack ASA4032640112725
Incident Response Plan Activated: True
Containment Measures: Isolation of affected systemsManual order processing to mitigate supply chain disruptions
Remediation Measures: System restoration (ongoing as of December 2023)Gradual resumption of production
Recovery Measures: Expected full system recovery by February 2024
Communication Strategy: Public press conference by CEO Atsushi KatsukiDelayed financial disclosures with promises of transparency post-recoveryApologies to customers for inconvenience
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Yes (investigation underway), , , Yes (IT teams engaged in system rebuild), Yes (partial recovery ongoing), , Yes (manual processing implemented), , , .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Type of Data Compromised: None confirmed
Number of Records Exposed: 0 (as per statement)
Data Exfiltration: None confirmed
Personally Identifiable Information: None confirmed
Incident : ransomware ASA2592025100725
Type of Data Compromised: Personal details (employees), Financial documents, Budgets, Contracts, Plans, Development forecasts
Sensitivity of Data: high (includes personally identifiable and business-sensitive information)
Data Exfiltration: yes (27 GB of files stolen)
Personally Identifiable Information: yes (employee details)
Incident : ransomware ASA1362013100825
Type of Data Compromised: Internal documents, Corporate files
Number of Records Exposed: 9,300+ files
Data Exfiltration: yes (claimed by Qilin)
Incident : Ransomware ASA3192031100825
Data Encryption: Yes (ransomware encrypted all computer systems)
Incident : ransomware ASA2492424100825
Type of Data Compromised: Financial records, Contracts, Business forecasts, Pii (employees)
Sensitivity of Data: High (financial + personal data)
Data Exfiltration: Confirmed (27 GB leaked; screenshots published by Qilin)
Data Encryption: Yes (ransomware encryption)
File Types Exposed: documentsspreadsheetsdatabases (assumed)
Personally Identifiable Information: Yes (employees' data)
Incident : Ransomware Attack ASA2162021101125
Type of Data Compromised: Corporate data (suspected), Potentially customer/partner data (unconfirmed)
Sensitivity of Data: Moderate (business operations data; no confirmation of PII exposure)
Data Encryption: ['Ransomware encryption of systems']
Incident : ransomware ASA2392123101525
Type of Data Compromised: Financial data, Employee personal information
Number of Records Exposed: Over 9,300 files
Sensitivity of Data: High (includes personal and financial data)
Incident : ransomware ASA5662456112725
Data Encryption: True
Incident : Ransomware Attack ASA4832448112725
Type of Data Compromised: Names, Gender data, Postal addresses, Phone numbers, Email addresses
Number of Records Exposed: 1,825,000 (1,525,000 customers + 300,000 external contacts/employees/family members)
Sensitivity of Data: Moderate to High (Personally Identifiable Information - PII)
Data Encryption: True
Incident : Ransomware Attack ASA4032640112725
Data Encryption: True
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Working to restore operations, restarted production at affected plants, , Manual order processing (fax/paper), In-person order collection, Gradual system restoration, , system restoration from backups (assumed), , Manual order processing via pen/paper/fax, Gradual restoration of IT systems, , system recovery in progress, , System restoration (ongoing as of December 2023), Gradual resumption of production, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by isolation of infected systems, disconnection of digital networks, , isolation of affected systems, manual order processing, , partial reopening of factories, isolation of affected systems (likely), , reversion to manual order processing (phone, fax, in-person), , system isolation, restoration efforts, , isolation of affected systems, manual order processing to mitigate supply chain disruptions and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : ransomware ASA1362013100825
Ransomware Strain: Qilin
Data Exfiltration: yes (27 GB claimed)
Incident : Ransomware ASA3192031100825
Ransomware Strain: Qilin
Data Encryption: Yes (all computer systems locked)
Incident : ransomware ASA2492424100825
Ransom Paid: Unclear (no confirmation of payment or refusal)
Ransomware Strain: Qilin
Data Encryption: Yes
Data Exfiltration: Yes (double-extortion)
Incident : Ransomware Attack ASA2162021101125
Ransomware Strain: Qilin
Data Encryption: True
Data Exfiltration: True
Incident : ransomware ASA2392123101525
Data Exfiltration: True
Incident : Ransomware Attack ASA3932439111225
Data Encryption: Yes (disabled internal order/shipment system)
Incident : ransomware ASA5662456112725
Data Encryption: True
Incident : Ransomware Attack ASA4832448112725
Ransomware Strain: Qilin
Data Encryption: True
Data Exfiltration: True
Incident : Ransomware Attack ASA4032640112725
Data Encryption: True
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through manual order and shipping processes, , Rebuilding digital infrastructure from scratch, Partial restart of 6 breweries by early October 2025, , gradual resumption of production (by 2024-10-10), prioritization of key products (Asahi Super Dry), expanded shipments from 2024-10-15, , Prioritizing shipments to larger customers, Limited production resumption, , Manual order processing (temporary workaround), phased resumption of product shipments, , Expected full system recovery by February 2024, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Ransomware Attack ASA2162021101125
Regulatory Notifications: Japanese government investigating under Active Cyber Defense Law (ACD)
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Ransomware ASA3192031100825
Lessons Learned: Unintended resilience of analog systems (e.g., fax machines) during cyberattacks, Importance of maintaining fallback operational protocols, Vulnerability of digital-only workflows to ransomware disruptions, Need for robust incident response plans to accelerate recovery
Incident : Ransomware Attack ASA2162021101125
Lessons Learned: Japan's reliance on legacy systems and low digital literacy increases vulnerability to cyber-attacks., Manual fallback processes (e.g., fax) are inefficient and disrupt modern supply chains., Ransomware-as-a-Service (RaaS) models enable less-skilled threat actors to target large organizations., Government intervention (e.g., ACD law) is critical but requires time to implement effectively.
Incident : Ransomware Attack ASA3932439111225
Lessons Learned: Legacy system integration during consolidation creates vulnerabilities; manual backup processes (e.g., fax) are insufficient for modern operations; competitor poaching of market share during downtime can have long-term brand loyalty impacts.
Incident : Ransomware Attack ASA4032640112725
Lessons Learned: The attack was described as 'beyond imagination' in sophistication, indicating gaps in Asahi's cybersecurity preparedness., CEO acknowledged that existing preventive measures were insufficient against advanced threats., Highlighted broader cultural issues in Japan regarding cybersecurity investment and prioritization.
What recommendations were made to prevent future incidents ?
Incident : Ransomware ASA3192031100825
Recommendations: Implement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measure
Incident : Ransomware Attack ASA2162021101125
Recommendations: Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.
Incident : Ransomware Attack ASA4032640112725
Recommendations: Increase cybersecurity investments without solely focusing on ROI justification., Enhance threat detection and response capabilities for sophisticated attacks., Improve incident response planning to minimize operational downtime., Conduct regular security audits and red-team exercises to test defenses.Increase cybersecurity investments without solely focusing on ROI justification., Enhance threat detection and response capabilities for sophisticated attacks., Improve incident response planning to minimize operational downtime., Conduct regular security audits and red-team exercises to test defenses.Increase cybersecurity investments without solely focusing on ROI justification., Enhance threat detection and response capabilities for sophisticated attacks., Improve incident response planning to minimize operational downtime., Conduct regular security audits and red-team exercises to test defenses.Increase cybersecurity investments without solely focusing on ROI justification., Enhance threat detection and response capabilities for sophisticated attacks., Improve incident response planning to minimize operational downtime., Conduct regular security audits and red-team exercises to test defenses.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Unintended resilience of analog systems (e.g., fax machines) during cyberattacks,Importance of maintaining fallback operational protocols,Vulnerability of digital-only workflows to ransomware disruptions,Need for robust incident response plans to accelerate recoveryJapan's reliance on legacy systems and low digital literacy increases vulnerability to cyber-attacks.,Manual fallback processes (e.g., fax) are inefficient and disrupt modern supply chains.,Ransomware-as-a-Service (RaaS) models enable less-skilled threat actors to target large organizations.,Government intervention (e.g., ACD law) is critical but requires time to implement effectively.Legacy system integration during consolidation creates vulnerabilities; manual backup processes (e.g., fax) are insufficient for modern operations; competitor poaching of market share during downtime can have long-term brand loyalty impacts.The attack was described as 'beyond imagination' in sophistication, indicating gaps in Asahi's cybersecurity preparedness.,CEO acknowledged that existing preventive measures were insufficient against advanced threats.,Highlighted broader cultural issues in Japan regarding cybersecurity investment and prioritization.
References
Where can I find more information about each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Source: Asahi Group Holdings Statement
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Source: Media Report (unspecified)
Date Accessed: 2025-MM-DD (Tuesday morning, day after disclosure)
Incident : ransomware ASA2592025100725
Source: ZeroFox Q3 2025 Ransomware Roundup
Incident : ransomware ASA2592025100725
Source: NCC Group August 2025 Ransomware Report
Incident : ransomware ASA1362013100825
Source: Reuters
Incident : ransomware ASA1362013100825
Source: eCrime.ch (cybercrime research platform)
Incident : Ransomware ASA3192031100825
Source: PayPerFax Research Compilation
Incident : Ransomware ASA3192031100825
Source: ABNewswire
Incident : ransomware ASA2492424100825
Source: Bloomberg
Incident : ransomware ASA2492424100825
Source: Qilin's dark web blog
Incident : ransomware ASA2492424100825
Source: Asahi Group Holdings Ltd. public statement (2024-10-09)
Incident : Ransomware Attack ASA2162021101125
Source: BBC News
URL: https://www.bbc.com/news/articles/cpv1v5d0v1xo
Date Accessed: June 2024
Incident : ransomware ASA2392123101525
Source: News report (unspecified)
Incident : Ransomware Attack ASA3932439111225
Source: Bloomberg
URL: https://www.bloomberg.com
Date Accessed: 2025-11-12
Incident : Ransomware Attack ASA3932439111225
Source: Nikkei Inc.
Incident : ransomware ASA5662456112725
Source: AFP (Agence France-Presse)
Incident : ransomware ASA5662456112725
Source: Asahi Group Holdings public statement (September 29, 2025)
Incident : ransomware ASA5662456112725
Source: Japanese media reports on Qilin's claim of responsibility
Incident : Ransomware Attack ASA4832448112725
Source: Asahi Group Holdings Official Announcement
Incident : Ransomware Attack ASA4832448112725
Source: BBC News
Incident : Ransomware Attack ASA4032640112725
Source: AFP (Agence France-Presse)
Incident : Ransomware Attack ASA4032640112725
Source: Japanese media reports (interpretation of Qilin's statement)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Asahi Group Holdings Statement, and Source: Media Report (unspecified)Date Accessed: 2025-MM-DD (Tuesday morning, day after disclosure), and Source: ComparitechDate Accessed: 2025-10-07, and Source: ZeroFox Q3 2025 Ransomware Roundup, and Source: NCC Group August 2025 Ransomware Report, and Source: Reuters, and Source: eCrime.ch (cybercrime research platform), and Source: BloombergDate Accessed: 2025-10-08, and Source: The Japan TimesDate Accessed: 2025-10-04, and Source: PayPerFax Research CompilationUrl: https://payperfax.com, and Source: ABNewswireUrl: https://www.abnewswire.com/email_contact_us.php?pr=when-ransomware-hit-in-2025-japans-biggest-brewery-survived-on-fax-machines, and Source: Bloomberg, and Source: Qilin's dark web blog, and Source: Asahi Group Holdings Ltd. public statement (2024-10-09), and Source: BBC NewsUrl: https://www.bbc.com/news/articles/cpv1v5d0v1xoDate Accessed: June 2024, and Source: ReutersDate Accessed: June 2024, and Source: AFP via Getty ImagesDate Accessed: June 2024, and Source: News report (unspecified), and Source: BloombergUrl: https://www.bloomberg.comDate Accessed: 2025-11-12, and Source: Nikkei Inc., and Source: AFP (Agence France-Presse), and Source: Asahi Group Holdings public statement (September 29, 2025), and Source: Japanese media reports on Qilin's claim of responsibility, and Source: Asahi Group Holdings Official Announcement, and Source: BBC News, and Source: TechRadarUrl: https://www.techradar.com, and Source: AFP (Agence France-Presse), and Source: Japanese media reports (interpretation of Qilin's statement).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Investigation Status: Active (cause under investigation)
Incident : ransomware ASA2592025100725
Investigation Status: ongoing (Asahi has not responded to Qilin’s claims)
Incident : ransomware ASA1362013100825
Investigation Status: ongoing (as of 2024-10-01)
Incident : Ransomware ASA3192031100825
Investigation Status: Ongoing (as of October 2025)
Incident : ransomware ASA2492424100825
Investigation Status: Ongoing (no details disclosed)
Incident : Ransomware Attack ASA2162021101125
Investigation Status: Ongoing (Japanese government and Asahi internal investigation)
Incident : ransomware ASA2392123101525
Investigation Status: Ongoing (systems not yet restored as of the report)
Incident : Ransomware Attack ASA3932439111225
Investigation Status: Ongoing (as of report date)
Incident : ransomware ASA5662456112725
Investigation Status: ongoing
Incident : Ransomware Attack ASA4832448112725
Investigation Status: Ongoing (no evidence of data misuse confirmed as of report)
Incident : Ransomware Attack ASA4032640112725
Investigation Status: Ongoing (as of December 2023)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public statement issued (apology to customers/partners), Public Disclosure Via Spokesperson Statement, Declined To Comment On Extortion Details, Public Disclosure Via Media (E.G., The Japan Times), Customer Advisories On Potential Shortages, Public Statement On 2024-10-09 (Wednesday), Spokesperson Updates, No Details On Ransom Negotiations, Public Apology For Disruptions, Updates Via Media (No Direct Timeline Provided), Public Statement By Ceo Atsushi Katsuki, Apology For Inconvenience, Public announcement on company website, Public Press Conference By Ceo Atsushi Katsuki, Delayed Financial Disclosures With Promises Of Transparency Post-Recovery and Apologies To Customers For Inconvenience.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Stakeholder Advisories: Public apology issued to customers and business partners
Customer Advisories: Yes (statement warning of service disruptions)
Incident : Ransomware ASA3192031100825
Stakeholder Advisories: Public Statements On Operational Status, Warnings To Retailers/Customers About Potential Shortages.
Customer Advisories: Notifications about order delaysPotential product shortages (e.g., Super Dry beer)
Incident : ransomware ASA2492424100825
Stakeholder Advisories: Limited Public Updates Via Spokesperson.
Customer Advisories: Indirect communication via retailers/restaurants on product availability
Incident : Ransomware Attack ASA2162021101125
Stakeholder Advisories: Apology Issued To Customers And Partners, No Detailed Advisory On Mitigation Steps.
Customer Advisories: Warnings of product shortages from Asahi and convenience store chains (FamilyMart, 7-Eleven, Lawson)
Incident : ransomware ASA5662456112725
Stakeholder Advisories: Delay In Financial Results Announcement, Phased Resumption Of Shipments.
Customer Advisories: apology for inconveniencerequest for understanding during recovery
Incident : Ransomware Attack ASA4832448112725
Customer Advisories: Public announcement acknowledging potential exposure of 1.825 million records
Incident : Ransomware Attack ASA4032640112725
Stakeholder Advisories: Delayed Financial Results Will Be Disclosed Once Systems Are Restored., Gradual Resumption Of Production And Shipments In Progress..
Customer Advisories: Apology for inconvenience caused by supply disruptions.Assurance that production is resuming in stages.
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Public apology issued to customers and business partners, Yes (statement warning of service disruptions), Public Statements On Operational Status, Warnings To Retailers/Customers About Potential Shortages, Notifications About Order Delays, Potential Product Shortages (E.G., Super Dry Beer), , Limited Public Updates Via Spokesperson, Indirect Communication Via Retailers/Restaurants On Product Availability, , Apology Issued To Customers And Partners, No Detailed Advisory On Mitigation Steps, Warnings Of Product Shortages From Asahi And Convenience Store Chains (Familymart, 7-Eleven, Lawson), , Delay In Financial Results Announcement, Phased Resumption Of Shipments, Apology For Inconvenience, Request For Understanding During Recovery, , Public announcement acknowledging potential exposure of 1.825 million records, Delayed Financial Results Will Be Disclosed Once Systems Are Restored., Gradual Resumption Of Production And Shipments In Progress., Apology For Inconvenience Caused By Supply Disruptions., Assurance That Production Is Resuming In Stages. and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : ransomware ASA2592025100725
High Value Targets: Employee Data, Financial And Business Documents,
Data Sold on Dark Web: Employee Data, Financial And Business Documents,
Incident : Ransomware ASA3192031100825
High Value Targets: Computer Systems, Factory Operations, Supply Chain Management,
Data Sold on Dark Web: Computer Systems, Factory Operations, Supply Chain Management,
Incident : ransomware ASA2492424100825
High Value Targets: Financial Data, Employee Pii, Business Forecasts,
Data Sold on Dark Web: Financial Data, Employee Pii, Business Forecasts,
Incident : Ransomware Attack ASA2162021101125
High Value Targets: Production Systems, Order Processing Databases,
Data Sold on Dark Web: Production Systems, Order Processing Databases,
Incident : ransomware ASA2392123101525
High Value Targets: Financial Data, Employee Personal Information,
Data Sold on Dark Web: Financial Data, Employee Personal Information,
Incident : Ransomware Attack ASA3932439111225
High Value Targets: Order/Shipment System, Financial Data,
Data Sold on Dark Web: Order/Shipment System, Financial Data,
Incident : ransomware ASA5662456112725
High Value Targets: Financial Systems, Supply Chain Systems,
Data Sold on Dark Web: Financial Systems, Supply Chain Systems,
Incident : Ransomware Attack ASA4832448112725
Entry Point: Equipment located at Asahi Group’s site
High Value Targets: Servers In The Data Center, Company-Issued Pcs,
Data Sold on Dark Web: Servers In The Data Center, Company-Issued Pcs,
Incident : Ransomware Attack ASA4032640112725
High Value Targets: Corporate It Systems, Financial Data,
Data Sold on Dark Web: Corporate It Systems, Financial Data,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Ransomware ASA3192031100825
Root Causes: Likely Initial Access Via Phishing Or Malicious File Download, Lack Of Network Segmentation To Contain Ransomware Spread, Over-Reliance On Digital Systems Without Tested Manual Fallbacks,
Corrective Actions: System Rebuild From Scratch, Partial Restoration Of Brewery Operations (6/30 Factories By Early October), Continued Reliance On Analog Systems (Fax/Paper) During Recovery,
Incident : Ransomware Attack ASA2162021101125
Root Causes: Over-Reliance On Legacy It Systems With Poor Security Controls., Insufficient Cybersecurity Workforce And Digital Literacy In Business Operations., Lack Of Preparedness For Ransomware Attacks (E.G., No Immediate Automated Fallbacks)., Cultural Trust In Systems Without Proportional Risk Management.,
Corrective Actions: Japanese Government'S Active Cyber Defense Law (Acd) Empowers Proactive Measures (E.G., Neutralizing Attacker Servers)., Asahi Likely Reviewing It Infrastructure Modernization And Cybersecurity Investments., Convenience Store Chains Diversifying Suppliers To Mitigate Single-Point Failures.,
Incident : Ransomware Attack ASA3932439111225
Root Causes: Vulnerabilities in legacy systems during integration; lack of resilient backup systems for order processing
Incident : Ransomware Attack ASA4032640112725
Root Causes: Insufficient Cybersecurity Measures Against Sophisticated Attacks., Potential Lack Of Network Segmentation Or Advanced Threat Detection.,
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: System Rebuild From Scratch, Partial Restoration Of Brewery Operations (6/30 Factories By Early October), Continued Reliance On Analog Systems (Fax/Paper) During Recovery, , Japanese Government'S Active Cyber Defense Law (Acd) Empowers Proactive Measures (E.G., Neutralizing Attacker Servers)., Asahi Likely Reviewing It Infrastructure Modernization And Cybersecurity Investments., Convenience Store Chains Diversifying Suppliers To Mitigate Single-Point Failures., .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Qilin ransomware group, Qilin (Ransomware-as-a-Service group), Qilin Ransomware Group, Qilin (Russian-speaking hacker group), Qilin Ransomware Group, Qilin, Qilin (suspected, Russia-based), Qilin Ransomware Group and Qilin (suspected Russian-based hacker group).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2024-09-29.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-09-29.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2024-10-02.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was Projected ¥15 billion core operating loss for Q4; full-year guidance expected to miss by 13%; higher marketing costs to win back customers.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were None confirmed (as per Asahi's statement), employee personal details, financial documents, budgets, contracts, plans, development forecasts, Type: ['internal documents', 'corporate data'], Volume: 27 GB (9,300+ files), , Type: ['internal documents', 'corporate data'], Volume: 27 GB (9,300+ files), , financial documents, contracts, development forecasts, employees' personal information, , , and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Order and shipment systems (group companies in Japan)Call center operationsCustomer service desks and serversorder and shipment systemscall center operations and beer production plants (6 locations in Japan) and All computer systems30 factoriesDigital order processingSupply chain management and production systemsdistribution networksorder processing and Production Systems (30 factories, including 6 breweries)Order Processing SystemsShipment Logistics SystemsCommunication Systems (reverted to fax) and and Order and shipment processing systemFinancial data accessSupply chain operations and financial reporting systemssupply chain/logistics systems and Servers in the data centerCompany-issued PCs and Corporate IT systemsFinancial reporting systemsOrder processing systems.
Response to the Incidents
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Isolation of infected systemsDisconnection of digital networks, isolation of affected systemsmanual order processing, Partial reopening of factoriesIsolation of affected systems (likely), Reversion to manual order processing (phone, fax, in-person), system isolationrestoration efforts and Isolation of affected systemsManual order processing to mitigate supply chain disruptions.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were contracts, development forecasts, budgets, employees' personal information, None confirmed (as per Asahi's statement), plans, financial documents and employee personal details.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 3.7M.
Ransomware Information
What was the highest ransom paid in a ransomware incident ?
Highest Ransom Paid: The highest ransom paid in a ransomware incident was Unclear (no confirmation of payment or refusal).
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Highlighted broader cultural issues in Japan regarding cybersecurity investment and prioritization.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enhance threat detection and response capabilities for sophisticated attacks., Implement hybrid (digital + analog) backup systems for critical operations, Accelerate digital transformation to replace legacy systems in Japanese businesses., Improve incident response planning to minimize operational downtime., Conduct regular security audits and red-team exercises to test defenses., Develop and test manual fallback procedures for cyber incident scenarios, Evaluate legacy system retention as a potential resilience measure, Prioritize supply chain resilience in cybersecurity strategies., Enhance employee training on phishing/malicious file risks, Implement robust incident response plans with automated fallback systems (not manual)., Increase cybersecurity investments without solely focusing on ROI justification., Enhance public-private collaboration for threat intelligence sharing under ACD law., Invest in network segmentation to limit ransomware spread and Invest in cybersecurity training and hiring to address the shortage of professionals..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Japanese media reports on Qilin's claim of responsibility, Asahi Group Holdings Official Announcement, Asahi Group Holdings public statement (September 29, 2025), TechRadar, Comparitech, The Japan Times, NCC Group August 2025 Ransomware Report, PayPerFax Research Compilation, Media Report (unspecified), Qilin's dark web blog, Nikkei Inc., ZeroFox Q3 2025 Ransomware Roundup, Reuters, Asahi Group Holdings Ltd. public statement (2024-10-09), eCrime.ch (cybercrime research platform), Bloomberg, AFP via Getty Images, News report (unspecified), BBC News, AFP (Agence France-Presse), Japanese media reports (interpretation of Qilin's statement), ABNewswire and Asahi Group Holdings Statement.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://payperfax.com, https://www.abnewswire.com/email_contact_us.php?pr=when-ransomware-hit-in-2025-japans-biggest-brewery-survived-on-fax-machines, https://www.bbc.com/news/articles/cpv1v5d0v1xo, https://www.bloomberg.com, https://www.techradar.com .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Active (cause under investigation).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Public apology issued to customers and business partners, Public statements on operational status, Warnings to retailers/customers about potential shortages, Limited public updates via spokesperson, Apology issued to customers and partners, No detailed advisory on mitigation steps, delay in financial results announcement, phased resumption of shipments, Delayed financial results will be disclosed once systems are restored., Gradual resumption of production and shipments in progress., .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Yes (statement warning of service disruptions), Notifications about order delaysPotential product shortages (e.g., Super Dry beer), Indirect communication via retailers/restaurants on product availability, Warnings of product shortages from Asahi and convenience store chains (FamilyMart, 7-Eleven, Lawson), apology for inconveniencerequest for understanding during recovery, Public announcement acknowledging potential exposure of 1.825 million records and Apology for inconvenience caused by supply disruptions.Assurance that production is resuming in stages.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Equipment located at Asahi Group’s site.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Likely initial access via phishing or malicious file downloadLack of network segmentation to contain ransomware spreadOver-reliance on digital systems without tested manual fallbacks, Over-reliance on legacy IT systems with poor security controls.Insufficient cybersecurity workforce and digital literacy in business operations.Lack of preparedness for ransomware attacks (e.g., no immediate automated fallbacks).Cultural trust in systems without proportional risk management., Vulnerabilities in legacy systems during integration; lack of resilient backup systems for order processing, Insufficient cybersecurity measures against sophisticated attacks.Potential lack of network segmentation or advanced threat detection..
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was System rebuild from scratchPartial restoration of brewery operations (6/30 factories by early October)Continued reliance on analog systems (fax/paper) during recovery, Japanese government's Active Cyber Defense Law (ACD) empowers proactive measures (e.g., neutralizing attacker servers).Asahi likely reviewing IT infrastructure modernization and cybersecurity investments.Convenience store chains diversifying suppliers to mitigate single-point failures..
.png)
Latest Global CVEs (Not Company-Specific)
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
Risk Information
cvss4
Base: 6.9
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Risk Information
cvss3
Base: 9.4
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Description
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
Risk Information
cvss3
Base: 8.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
Risk Information
cvss3
Base: 5.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=asahigroup-holdings' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
