In September 2025 ransomware on Asahi's business network, and the shutdown that contained it, stopped orders and shipments across Japan. The breweries were producing again on day four. The shelves took until February.
Nothing in Asahi's record says the attacker touched a factory. Its releases describe encrypted servers and company PCs in a Japanese data center, and the factory systems were described, as the trade press reported the November press conference, as unaffected. What stopped twenty factories was the containment. The people deserve saying so plainly: they restored from backups, shipped on paper, fax and spreadsheets from the third day, and had all six breweries running on the fourth.
The finding is in the gap between the fourth day and February. A brewery can run without the order system; distribution cannot. A hand-run path built during an emergency covers the products people ask for most, not the catalogue. Fallback capacity, not attacker skill, set the duration. That reading is BlastWave's analysis, not a disclosed fact.
What is not known: Asahi says the attacker came in through network equipment at one of its sites about ten days before the outage, and it is believed a password weakness gave administrator rights. Which device, and what the weakness was, are undisclosed. Asahi has never named a group; Qilin claimed it on its leak site, and the claim has never been confirmed. No written Asahi release says factory control systems were examined and found clean; that comes from press accounts of a press conference. How many products were cut from the hand-run shipping list, and a total incident cost, are also undisclosed.
Recommendation
Take the path away from what ships Order entry, dispatch and production scheduling should not be reachable from a network a stranger enters through one device at one site.
Remove credential-based admin access No administrator rights reachable with a password alone, from anywhere. Bind administration to a verified identity and device.
Read orders one way; rehearse by hand Sites receive the order book over a one-way path, so business-side containment does not blind them, and manual dispatch for the full product list is rehearsed.
Sources: Asahi releases, 29 Sep to 8 Oct 2025; Asahi investigation results, 27 Nov 2025; Recurrence prevention report, 18 Feb 2026; FY2025 results presentation, 9 Jul 2026; Material weakness notice, 27 Jul 2026. Full list with links.
Soft Spots: That factory systems were unaffected is a press-conference statement reported by the press, not a line in a written Asahi release. That fallback capacity, not attacker skill, set the duration is BlastWave's analysis.
The full record
Every claim numbered to its source. Last updated .
Ransomware on Asahi's business network in Japan, and the shutdown that contained it, stopped orders and shipments. The breweries were producing again on day four; the shelves took until February. What is verified, what is only reported, and what is still unknown.
Summary
In September 2025, ransomware hit Asahi Group's data center network in Japan, and, by Asahi's account, the containment measures stopped order placement and shipping. All six breweries were producing again on 2 October; delivery lead times were normal by February 2026. Qilin claimed the attack; Asahi has named no group, and no factory control system is reported affected.3,4,5,7,8
Timeline of the Asahi ransomware attack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
By Asahi's account, an attacker gains unauthorized access through network equipment at a group site; Asahi believes it then reconnoitered multiple servers, mainly after business hours.3
A system disruption begins. Investigators find encrypted files.1
Asahi disconnects the network and isolates the data center. Order and shipment operations at group companies in Japan are suspended; Asahi says the failure is limited to Japan.1,2
Reuters, as carried by TechCrunch, quotes an Asahi spokesperson saying the company is "still investigating whether all its 30 plants across Japan have suspended operations."12
Asahi Breweries, Asahi Soft Drinks and Asahi Group Foods resume shipping by hand on paper, fax and spreadsheets, as Asahi's November press conference was reported.8
All six Asahi Breweries factories in Japan are producing again.4
Asahi confirms ransomware, reports traces suggesting a potential unauthorized transfer of data, and says order placement and product shipment were affected "as a result of the containment measures." Manual order handling is under way.7
Qilin lists Asahi on its leak site, claiming more than 9,300 files and 27GB of data. Asahi does not confirm the claim.5
Asahi gives its own count: 20 factories across three operating companies. Asahi Group Foods' seven are partially producing; Asahi Soft Drinks' seven follow from 9 October. Partial Super Dry shipments have resumed, with Asahi Draft Beer and Asahi Dry Zero to follow on 15 October. Data suspected to be Asahi's has been identified on the internet.4
Asahi says its third quarter results disclosure will exceed the 45-day period after the quarter's end.13
Bloomberg reports, citing Nikkei point-of-sale data, that Kirin took the lead in Japan's retail beer market after 6 October.14
Asahi publishes its investigation results: entry through network equipment at a group site; personal information of about 1,914,000 individuals may have been exposed; no credit card data; restoration took about two months. It also publishes October sales by operating company.1,15
Asahi publishes its recurrence prevention measures, including the ten-day account of the intrusion, the full scope of the containment, and a move of remote access to a zero-trust model.3
Asahi cuts its fiscal 2025 net profit forecast from ¥167.5bn to ¥120.0bn, citing several causes together.10
Delayed fiscal 2025 results are published. The results presentation estimates about ¥17.0bn of profit decline from the system disruption.9
Asahi reassesses the potentially exposed population to about 2,289,000 individuals, adding about 378,000 business partners.11
Asahi reports a material weakness in internal control over financial reporting.6
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What stopped orders and shipping?
In Asahi's words, order placement and shipment were affected "as a result of the containment measures". How much of the order platform was itself encrypted is undisclosed7
Verified (Asahi's words)
Were factory systems affected?
Described as unaffected at the 27 November 2025 press conference, as the trade press reported it. No written Asahi release says so8
Reported only
How many factories?
20, across three operating companies (6, 7 and 7), in Asahi's count of 8 October 20254
Network equipment at a group site; "it is believed" a password vulnerability gave administrative privileges1,3
Company's belief
Which device, and what weakness?
Not disclosed
Undisclosed
Who was behind it?
Claimed by Qilin on its leak site. Asahi has named no group; no government attribution5
Claimed only
Was a ransom paid?
No, by the president's account at the 27 November 2025 press conference, as reported. A company statement, not a verified fact8,16
Reported only
How many people's data may have been exposed?
About 1,914,000 (27 November 2025), reassessed to about 2,289,000 (17 July 2026). No card data1,11
Verified (dated)
When did ordering and delivery recover?
Electronic ordering 2 to 3 December 2025; delivery lead times normal by February 20263
Verified
Total incident cost
Not published. ¥17.0bn is Asahi's estimate of profit impact, not a total9
Undisclosed
Were Asahi's breweries and factories hacked?
Nothing in Asahi's record says the attacker reached a factory, and no written Asahi release says the factory systems were examined and found clean. Asahi's releases describe ransomware that encrypted several servers and some company-issued PCs connected to the data center network in Japan.1 At the 27 November 2025 press conference, the factory systems were described as unaffected, as the trade press reported it:
"工場のシステムには影響は出ていない"
That is a press-conference statement reported by the press, not a line in any written Asahi release. The accurate summary keeps two statements apart: nothing in the record says the factories were reached, and nothing in the written record says they were checked and found clean. Neither should be tightened into "the factories were hacked" or "the factory systems were clean."
Why did Asahi's production and shipping stop?
By Asahi's own account, because of the containment. At about 11:00 a.m. on 29 September 2025, Asahi disconnected the network and isolated the data center.1 Its February 2026 recurrence report lists what was cut: all remote access VPNs, the inter-site network of about 300 sites, and the dedicated lines for inter-cloud connectivity.3 On 3 October 2025 Asahi wrote:
"As a result of the containment measures, operations across our domestic group companies ... have been affected."
The factories stopped because orders and dispatch stopped, not by attacker action on the plant. How much of the order platform was itself encrypted is not disclosed. Reading the stop as a consequence of containment rather than of encryption is BlastWave's inference, supported by Asahi's own phrase; it is not a disclosed fact.
How long did Asahi take to recover?
Four days to brew again, about two months to restore the systems, and until February 2026 for normal delivery times. The record, in order:
From 1 October 2025, day three, shipping resumed by hand on paper, fax and spreadsheets, as the press conference was reported. Asahi's own 3 October release confirms manual order handling was under way, without a date, and calls ensuring product supply the top priority.7,8
All six Asahi Breweries factories were producing from 2 October. Asahi Group Foods' seven factories were partially producing by 8 October, and Asahi Soft Drinks' seven from 9 October.4
Partial shipments of Super Dry resumed first; Asahi Draft Beer and Asahi Dry Zero were scheduled for 15 October.4
October 2025 sales against the year before, in Asahi's words: the brewery business "over 90%," soft drinks "roughly 60%," foods "over 70%."15
Containment and restoration took about two months.1 Electronic ordering resumed on 2 to 3 December 2025, and delivery lead times were normal by February 2026.3
At the same press conference, as Impress Cloud Watch reported it, the company said its backups had survived intact:
"幸いなことに、そのバックアップが生きていた。"
Bloomberg reported on 13 November 2025, citing Nikkei point-of-sale data, that Kirin took the lead in Japan's retail beer market after 6 October.14 It is a reported market measurement with a date on it, not a share figure.
How did the attackers get into Asahi's network?
Through network equipment at one of the group's sites, by Asahi's account, about ten days before the outage. Asahi said in November 2025 that the attacker gained unauthorized access to the data center network through network equipment at a group site.1 Its February 2026 report adds the timing, "although the specific date and time could not be determined," and the mechanism, stated as a belief:
"It is believed that the attacker ... exploited a password vulnerability to gain administrative privileges."
The same report says, again as a belief, that the attacker repeatedly accessed and reconnoitered multiple servers, mainly after business hours. Which device was used, and what the password weakness was, are undisclosed. In July 2026 Asahi reported a material weakness in internal control over financial reporting, finding that information security rules were "not sufficiently implemented in certain parts" of its information system infrastructure.3,6
Who was behind the Asahi attack, and was data taken?
Qilin claimed it; Asahi has named no group, and no government has attributed it.In early October 2025 Qilin listed Asahi on its leak site, claiming more than 9,300 files and 27GB of data; Asahi did not confirm the claim.5 The only corroboration is Asahi's 8 October statement that data suspected to have been transferred in the attack had been "identified on the internet," which names no one.4 Asahi calls the malware ransomware and has never named a family.7
On personal data, the figures are dated and conditional. On 27 November 2025 Asahi said personal information of about 1,914,000 individuals "may have been exposed," with no credit card data.1 On 17 July 2026 it reassessed the potentially exposed population to about 2,289,000, adding a business partners category of about 378,000.11 Neither figure is a finding that any individual's data was stolen or leaked.
How much did the Asahi attack cost?
Asahi has published no total incident cost. The ¥47.5bn figure is the cut to the fiscal 2025 net profit forecast, from ¥167.5bn to ¥120.0bn, announced on 11 June 2026. The notice names lower revenue from the system failure, higher raw material costs, and impairment losses and system disruption expenses together.10 It is not the cost of the attack.
Asahi's own narrower figure is in its results presentation of 9 July 2026: an estimated ¥17.0bn decline in profit from inventory disposal and valuation loss, system restoration personnel costs, and cancelled advertising and sales promotions. The same slide lists further one-off items for 2026, about ¥6.0bn for promotions and ¥3.5bn for information security.9 Asahi calls the impact an estimated value. It is a company estimate of profit impact, not a total cost. The cleanest measure remains the October 2025 sales percentages.15
What is still not known about Asahi
Which network device at which site the attacker came through, and what the password weakness was.3
The date of entry. Asahi says only about ten days before the outage; the specific date and time "could not be determined."3
Who carried out the attack. Qilin's leak-site claim has never been confirmed by Asahi or any government.
Whether the factory control systems were examined and found clean. No written Asahi release says so; the statement that they were unaffected comes from press accounts of the press conference.
How much of the order platform was itself encrypted.
How many products were left off the hand-run shipping list.
A total incident cost.
Claims about Asahi the record does not support
Widely repeated claim
What the record says
"Asahi halted about 30 factories."
The figure traces to a spokesperson on 30 September 2025 who, per Reuters as carried by TechCrunch, said the company was "still investigating whether all its 30 plants" had stopped. Asahi's own count, on 8 October 2025, is 20 factories: six, seven and seven.4,12
"The attack cost Asahi ¥47.5bn."
¥47.5bn is the June 2026 cut to the net profit forecast, with several named causes. Asahi's own estimate of profit impact is about ¥17.0bn, and that is not a total cost either.9,10
BlastWave analysis: fallback capacity set the clock
Analysis, not a disclosed fact
Asahi belongs in a record of operational technology incidents because nothing in its record says the attacker touched any. What stopped twenty factories was the containment anyone would have chosen, and on the consequence ladder that is an IT compromise halting physical operations, the same rung as Colonial Pipeline a sector away. The people deserve saying so plainly. They restored from backups that survived intact, paid no ransom by the president's account, shipped on paper, fax and spreadsheets from the third day, and had all six breweries running on the fourth.4,8
The finding is in the gap between the fourth day and February. Production came back in four days because a brewery can run without the order system. Distribution took two months for the order system and until February for delivery lead times, because a hand-run path built during an emergency covers the products people ask for most and not the catalogue. Super Dry shipped first and other labels waited.3,4 Fallback capacity, not attacker skill, set the duration. That reading is BlastWave's analysis, not a disclosed fact.
Podcast: “The Lending Library” (8:25). Joe Baxter and Cam Cullen on why the breweries came back in four days and the shelves took until February.
Video: Asahi Short (60 to 90 seconds).
Frequently asked questions
What happened in the Asahi cyberattack?
At about 7:00 a.m. JST on 29 September 2025, Asahi Group's systems in Japan began failing, and investigators found encrypted files. At about 11:00 a.m. Asahi disconnected its network and isolated the data center. Asahi confirmed ransomware on 3 October and said orders and shipments were affected as a result of the containment measures. Its breweries were producing again on 2 October, and delivery lead times were normal by February 2026.
Were Asahi's breweries or factory systems hacked?
Nothing in Asahi's record says the attacker reached a factory. Asahi's releases describe encrypted servers and company PCs on its data center network in Japan. At the 27 November 2025 press conference the factory systems were described as unaffected, as Impress Cloud Watch reported it, but no written Asahi release says they were examined and found clean.
Why did Asahi stop production and shipping?
Asahi wrote on 3 October 2025 that order placement and product shipment were affected as a result of the containment measures. In BlastWave's reading, cutting the network took down the systems that take orders and dispatch goods, so the factories had nothing to ship against; how much of the order platform was itself encrypted is not disclosed. All six breweries were producing again by 2 October, but electronic ordering did not resume until 2 to 3 December 2025.
Who was behind the Asahi ransomware attack?
The Qilin ransomware group claimed the attack on its leak site in early October 2025, according to BleepingComputer, which reported a claim of more than 9,300 files and 27GB of data. Asahi has never named any group, and no government has attributed the attack. Asahi said on 8 October 2025 that data suspected to be its own had appeared on the internet.
How did the attackers get into Asahi's network?
Asahi said in its February 2026 recurrence report that an attacker entered through network equipment at a group site about ten days before the outage, although the exact date could not be determined. Asahi said it is believed the attacker exploited a password vulnerability to gain administrative privileges. The device and the weakness have not been disclosed.
Did Asahi pay a ransom?
Asahi's president said at the 27 November 2025 press conference that no ransom was paid, as reported by Reuters and Impress Cloud Watch. Impress reported that the attackers had made no contact and so had made no ransom demand. This is a company statement reported by the press, not an independently verified fact.
How much did the Asahi cyberattack cost?
Asahi has published no total cost. The often-quoted ¥47.5bn is the June 2026 cut to its fiscal 2025 net profit forecast, which named several causes, including higher raw material costs. Asahi's July 2026 results presentation estimated about ¥17.0bn of profit decline from inventory disposal, restoration staffing and cancelled promotions, a profit impact rather than a total cost.
How many people's data was exposed in the Asahi attack?
On 27 November 2025 Asahi said personal information of about 1,914,000 individuals may have been exposed, with no credit card data. On 17 July 2026 it reassessed that figure to about 2,289,000, adding about 378,000 business partners. Both figures describe people whose data may have been exposed, not a finding that their data was stolen.
Primary sources are Asahi Group Holdings' own dated releases, notices and results materials, in English and Japanese. Press, including Japanese trade press reporting the November 2025 press conference, is cited only as evidence of what was said.
CompanyAsahi Group Holdings, "Investigation Results and Future Measures on Cyberattack Data Exposure," 27 November 2025 (English release 20251127-0204; Japanese 20251127-0104). asahigroup-holdings.com
CompanyAsahi Group Holdings, "Notice of System Failure Due to Cyberattack," 29 September 2025 (English release 20250929-0202; Japanese 20250929-0102). asahigroup-holdings.com
CompanyAsahi Group Holdings, "Measures to Prevent Recurrence of System Disruption by a Cyberattack and Strengthening the Governance System," 18 February 2026 (English release 20260218-0201; Japanese 20260218-0101). asahigroup-holdings.com
CompanyAsahi Group Holdings, "Update on System Disruption Due to Cyberattack (3rd)," 8 October 2025 (English release 20251008-0201). asahigroup-holdings.com
PressBleepingComputer, report on Qilin's leak-site claim against Asahi, 8 October 2025. Cited as evidence of what was said. bleepingcomputer.com
Company filingAsahi Group Holdings, "Notice Regarding a Material Weakness in Internal Control over Financial Reporting," 27 July 2026 (English release 20260727-0204). asahigroup-holdings.com
CompanyAsahi Group Holdings, "Update on System Disruption Due to Cyberattack (2nd)," 3 October 2025 (English release 20251003-0204; Japanese 20251003-0104). asahigroup-holdings.com
PressImpress Cloud Watch (三浦優子), "アサヒグループHDが攻撃被害の概要を説明、現時点で犯人側からの身代金要求はなし" ("Asahi Group HD explains the outline of the attack damage; no ransom demand from the attackers so far"), 28 November 2025, in Japanese. Report of Asahi's 27 November 2025 press conference. Cited as evidence of what was said. cloud.watch.impress.co.jp
Company filingAsahi Group Holdings, "Presentation Materials for 2025 Corporate Results," 9 July 2026, slide 29, "Reference: Estimated Impact of System Disruption"; with the FY2025 Financial Results release, 8 July 2026 (English release 20260708-0201). PDF · Results release, 8 July 2026
Company filingAsahi Group Holdings, "Notice Regarding Revision of Full-Year Consolidated Financial Results Forecast for the Fiscal Year Ended December 31, 2025," 11 June 2026 (English release 20260611-0201). asahigroup-holdings.com
CompanyAsahi Group Holdings, "Regarding Personal Information That May Have Been Exposed Due to a Cyberattack," 17 July 2026 (English release 20260717-0201). asahigroup-holdings.com
PressTechCrunch, 30 September 2025, carrying Reuters' report quoting an Asahi spokesperson. Cited as evidence of what was said. techcrunch.com
Company filingAsahi Group Holdings, notice of postponement of the fiscal 2025 third quarter results announcement, 14 October 2025 (English release 20251014-0102). asahigroup-holdings.com
PressBloomberg, report on Asahi's October 2025 sales, as republished by Claims Journal, 13 November 2025, citing Nikkei point-of-sale data. Cited as evidence of what was said.
CompanyAsahi Group Holdings, "Business Progress Update in View of Delayed FY2025 Q3 Results Announcement," 27 November 2025 (English release 20251127-0202). asahigroup-holdings.com
PressReuters (Anton Bridge), report of Asahi's 27 November 2025 press conference, as republished by Insurance Journal, 3 December 2025. Cited as evidence of what was said.
Cite this page
BlastWave. “Asahi Ransomware Attack (2025): What Is Verified.” Hackopedia, Volume 2, FILE 035. Last verified 28 September 2026. https://hackopedia.blastwave.com/food-beverage-retail/asahi-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 035 in Hackopedia Volume 2, in the Food, Beverage and Retail edition.
2 Oct 2026
Wording on Asahi's backups aligned with the trade press report of the 27 November 2025 press conference: the backups survived intact.
28 Sep 2026
Hand-check at source: the Japanese trade press report of Asahi's 27 November 2025 press conference was read to confirm the statements on factory systems, manual shipping from 1 October, intact backups and the absence of attacker contact; Asahi's results presentation slide on the estimated impact of the system disruption was read to confirm the ¥17.0bn figure; the Reuters report on the ransom and the Bloomberg report on retail share were confirmed in republication.
26 Sep 2026
Full validation: Asahi's releases from 29 September 2025 to 27 July 2026 were re-read at source. Label resumption dates are given only for the two labels Asahi dated to 15 October, the results postponement is described only as exceeding the 45-day disclosure period, as the notice says, and the comparison with the Port of Nagoya was corrected to match that entry's record.
24 Sep 2026
Entry built from primary sources: Asahi's own dated releases in English and Japanese, its recurrence prevention report and its results materials. Both personal data counts are carried with their dates.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
