Asahi cyberattack exposed 1.5M customers' data
Attack Disrupted Supply Chain
The ransomware attack, which struck on September 29, forced widespread suspension of operations including order processing, shipping and call center functions. The disruption caused restaurants, bars and stores across Japan to run low on Asahi products, including its best-selling Super Dry beer. The company was forced to resume production at six domestic factories the week following the attack and process orders manually by phone, fax and handwritten notes.
Ransomware group Qilin, believed to be based in Russia, claimed responsibility for the attack on October 9. The group has emerged as the world's most active ransomware operator in 2025, claiming more than 700 attacks this year and targeting critical sectors including manufacturing, financial services and healthcare.
Rising Threat in Japan
The attack on Asahi is part of a broader surge in ransomware incidents targeting Japanese companies. The Tokyo Metropolitan Police Department reported 116 ransomware attacks in the first half of 2025, matching a record previously seen in 2022. Cybersecurity experts say Japanese companies are increasingly attractive targets due to perceived weaker defenses and a tendency to pay ransoms through back channels.
