INCIDENT REPORT · CP-2025-018

Asahi Group ransomware attack

L3 · ELEVATEDCONFIRMED

Japan's largest brewer suffered a ransomware attack that knocked out its ordering, shipping and call-centre systems in Japan.

Incident ID: CP-2025-018
Disclosure date: 29 SEP 2025
Detection date: 29 SEP 2025
Affected countries: Japan
Plotted location: Tokyo, Japan (Affected organization headquarters (Sumida, Tokyo))
Threat classification: Level 3 — ELEVATED
Classification rationale: Nationwide production and distribution halt at a major food and beverage manufacturer.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Manufacturing, Food & Agriculture, Logistics
Critical infrastructure: No
Organizations affected: Asahi Group Holdings
Operational consequences: Orders and shipments in Japan were suspended and production halted at most domestic factories, with manual workarounds used for weeks. Asahi later reported that personal data of about 1.9 million people may have been exposed.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Claimed by the Qilin ransomware group; not confirmed by Asahi

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Asahi Group ransomware attack

L3 · ELEVATEDCONFIRMED

Japan's largest brewer suffered a ransomware attack that knocked out its ordering, shipping and call-centre systems in Japan.

Incident ID

CP-2025-018

Disclosure date

29 SEP 2025

Detection date

29 SEP 2025

Affected countries

Japan

Plotted location

Tokyo, Japan (Affected organization headquarters (Sumida, Tokyo))

Threat classification

Level 3 — ELEVATED

Classification rationale

Nationwide production and distribution halt at a major food and beverage manufacturer.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Manufacturing, Food & Agriculture, Logistics

Critical infrastructure

Organizations affected

Asahi Group Holdings

Operational consequences

Orders and shipments in Japan were suspended and production halted at most domestic factories, with manual workarounds used for weeks. Asahi later reported that personal data of about 1.9 million people may have been exposed.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Claimed by the Qilin ransomware group; not confirmed by Asahi