AGH
Company Details
Linkedin ID:
asahigroup-holdings
Employees number:
1,129
Number of followers:
202,985
NAICS:
722
Industry Type:
Homepage:
asahigroup-holdings.com
IP Addresses:
0
Company ID:
ASA_1348957
Scan Status:
In-progress
Asahi Group Holdings Company CyberSecurity Posture
asahigroup-holdings.com
Asahi Group Holdings, Ltd. is a global leader offering a diverse collection of brands centered on beer, alcohol and non-alcohol beverages, and food. Our mission is to deliver on our great taste promise and bring more fun to life. Established in Japan in 1889, the Group has always been committed to innovation and quality. This dedication has brought together iconic brands and the expertise of renowned breweries from around the world, including those with a rich heritage spanning over centuries. Our approach has culminated in a globally recognized portfolio of brands that includes premium beers such as Asahi Super Dry, Peroni Nastro Azzurro, Kozel, Pilsner Urquell, and Grolsch. “Make the world shine” articulates Asahi Group’s commitment to build connections among people, thereby paving the way for a sustainable future together. Through these connections, we can contribute to a brighter world, both today and in the future. With a global presence primarily in Japan and East Asia, Europe, Asia Pacific, we provide over 10 billion liters of beverages to consumers worldwide and generate revenues of over JPY 2.9 trillion annually. Headquartered in Japan, Asahi Group Holdings is listed on the Tokyo Stock Exchange (Prime Market: 2502.T). Must be legal drinking age to follow. Please share content with those who are of legal drinking age only.
Asahi Group Holdings A.I CyberSecurity Scoring
AGH Risk Score (AI oriented)Between 0 and 549
AGH
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
AGH Global Score (TPRM)XXXX
AGH
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
AGH Company CyberSecurity News & History
Past Incidents
13
Attack Types
2
Asahi Group Holdings
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Japanese beverage giant **Asahi** suffered a **cyberattack** leading to a **system failure** that severely disrupted its operations in Japan. The incident forced the company to **halt order processing, shipments, and call center services**, crippling customer support and logistics. While Asahi confirmed **no personal or customer data was leaked**, the attack caused **operational paralysis**, affecting its ability to fulfill deliveries and manage business communications. The company, which owns global brands like **Peroni and Grolsch** and operates **30 factories in Japan**, reported over **$9 billion in revenue** for H1 2025. No ransomware group claimed responsibility, and Asahi did not confirm the attack type, but the **prolonged outage**—with no estimated recovery timeline—highlights significant **business continuity risks**. The incident aligns with a rising trend of cyberattacks on beverage manufacturers, with prior ransomware strikes on breweries in Europe and Russia.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Asahi Group Holdings, a major Japanese food and beverage company, suffered a **ransomware attack** claimed by the hacker group **Qilin** on **October 7, 2024**. The attackers allegedly stole **over 9,300 data files**, including **financial records and personal information of employees**. While it remains unclear whether **customer or business partner data** was compromised, the breach forced the company to **postpone its Q1–Q3 earnings release** (originally scheduled for **November 12**) due to system disruptions. The company **confirmed the leaked data’s presence online** the following day, and its systems **remain unrecovered**, forcing manual order processing. The attack’s financial and operational impact includes **delayed reporting, potential reputational damage, and operational inefficiencies**, though the full scope of data exposure—particularly regarding customers—is still under investigation. The involvement of ransomware and theft of **employee personal data** elevates the incident’s severity, with potential long-term consequences for trust and regulatory compliance.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi, a major Japanese beer manufacturer, suffered a **ransomware attack** on **September 29**, initially described as a 'system failure' but later confirmed as a **Qilin ransomware** incident. The attack disrupted **ordering, shipping, and call center operations**, forcing the company to revert to manual processes (pen, paper, and fax). The ransomware group claimed to have stolen **~27 GB of data**, including **employee records (ID cards, personal documents), financial data, contracts, and forecasts**, raising fears of **personal data theft**. The breach caused **prolonged operational disruptions**, including **shipment delays, stock shortages, and deferred financial reporting** (Q3 results postponed). While breweries resumed production, IT systems remained crippled, with no clear recovery timeline. The attack’s broader impact includes **reputational damage, financial instability, and potential legal liabilities** under data protection laws. Asahi is investigating the **scope of stolen data** but has yet to confirm definitive theft, though the ransomware group’s leaked samples (e.g., employee IDs) suggest **significant data compromise**.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Two months after a **ransomware attack**, Asahi Group Holdings—Japan’s leading beverage manufacturer—continues to face severe operational disruptions. Retailers are experiencing shortages of Asahi’s products, including beer and other beverages, forcing them to switch to competitors like **Kirin, Sapporo, and Suntory**. The prolonged outage has not only strained supply chains but also eroded market share and customer trust. The attack’s lingering effects highlight critical vulnerabilities in Asahi’s cybersecurity infrastructure, with systems and logistics still not fully restored. Financial losses stem from lost sales, reputational damage, and potential long-term shifts in consumer loyalty. The incident underscores how ransomware can cripple production, distribution, and revenue streams, posing an existential threat to business continuity if recovery is delayed.
Asahi Group Holdings (Asahi Beer)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi Beer, a subsidiary of Japan’s Asahi Group Holdings, fell victim to a ransomware attack claimed by the **Qilin** ransomware group—part of the newly formed coalition with **DragonForce** and **LockBit**. The attack disrupted Asahi’s operations, with reports suggesting potential data exfiltration, including sensitive corporate and possibly customer information. While the full scope of the breach remains undisclosed, Qilin’s involvement signals a high-risk scenario, given the group’s history of targeting large enterprises for financial gain and reputational damage. The attack aligns with the coalition’s stated intent to escalate ransomware campaigns, leveraging combined resources to maximize pressure on victims. Asahi’s incident underscores the growing threat of RaaS (Ransomware-as-a-Service) collaborations, where groups pool expertise to bypass defenses and demand higher ransoms. The breach may have also exposed proprietary business data, supply chain details, or employee records, amplifying operational and legal risks. Asahi has not confirmed whether a ransom was paid or if data was leaked, but the attack reflects the broader trend of ransomware gangs targeting high-profile brands to extract concessions.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi, Japan’s leading brewer with 40% market share, suffered a **ransomware attack** attributed to the Qilin group, forcing it to halt production at most of its 30 factories, including six breweries. The attack crippled its computer systems, reducing operations to manual processes (pen, paper, and fax), severely limiting order processing and shipments. This caused widespread shortages of its products—beer (e.g., Asahi Super Dry), soft drinks, bottled teas, and food items—across convenience stores (FamilyMart, 7-Eleven, Lawson), liquor stores, and restaurants nationwide. Wholesalers reported receiving only **10–20% of normal supply**, with disruptions expected to last at least a month. While European subsidiaries (Peroni, Grolsch, Fuller’s) remained unaffected, the attack exposed Asahi’s **legacy system vulnerabilities** and **data leaks** (suspected stolen data found online). The incident underscored Japan’s broader cybersecurity gaps, including reliance on outdated infrastructure and low digital literacy, prompting government intervention under the new **Active Cyber Defense Law (ACD)**. The financial and reputational damage extends beyond Asahi to retailers, suppliers, and consumers, with no confirmed timeline for full recovery.
Asahi Group Holdings Ltd.
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi Group Holdings Ltd., Japan’s largest brewer, suffered a **ransomware attack** that crippled its internal order and shipment systems, forcing a manual fallback (phone, fax, in-person). Over a month later, operations remain at just **10% capacity**, severely disrupting supply during December—its peak sales month (12% of annual volume from Super Dry alone). The attack caused **stockouts in bars, restaurants, and gift markets**, leading rivals (Kirin, Sapporo, Suntory) to seize market share by replacing Asahi’s dispensing units and glassware. Financial losses include a projected **¥15 billion core operating loss** in Q4, a **13% miss on full-year guidance**, and delayed earnings reports due to inaccessible financial data. The breach exploited vulnerabilities in Asahi’s **fragmented legacy systems** (from acquisitions), compounding recovery challenges. While retail shelves show partial availability, **on-premise sales (bars, izakayas) face long-term loyalty risks**, with some outlets permanently switching brands. The incident also disrupted Japan’s corporate gifting tradition, further damaging revenue and reputation during the critical year-end season.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi Group Holdings, Japan’s leading brewer and producer of *Asahi Super Dry*—the country’s most popular beer—faced a severe operational shutdown due to a **ransomware attack** that crippled its systems. The cyberattack forced the closure of the majority of its **30 national breweries** since early in the week, halting production and disrupting **order and delivery systems** entirely. The incident has triggered an **imminent beer shortage** across Japan, with no confirmed timeline for recovery. The attack exposed critical vulnerabilities in Japan’s cybersecurity infrastructure, compounded by the company’s reliance on **outdated systems** and a broader national deficit in cybersecurity expertise. While the immediate financial and reputational damage to Asahi is substantial—given its dominance in the market—the broader implications include **supply chain disruptions**, potential long-term customer loss, and erosion of trust in domestic cyber defenses. The incident also underscores Japan’s systemic risks, where **legacy IT infrastructure** and a shortage of 110,000 cybersecurity professionals leave industries exposed to escalating threats. The government’s delayed response, including pending **2026 cyberdefense laws**, further exacerbates the crisis.
Asahi Group
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The **Asahi Group**, a Tokyo-based multinational beverage and food company, fell victim to a **ransomware attack** by the **Qilin ransomware group**. The attackers claimed to have exfiltrated **27 GB of sensitive data**, including **personal details of employees**, **financial documents**, **budgets**, **contracts**, **business development plans**, and **forecasts**. The breach caused **significant operational disruptions**, forcing Asahi to **suspend order and shipment operations in Japan**, as well as **shut down call center and customer service desks**. While the company is gradually resuming operations through manual processes, the incident highlights severe **data exposure risks** and **business continuity threats**.The Qilin group, known for its **technically mature RaaS (Ransomware-as-a-Service) model**, has been highly active, accounting for **16% of global ransomware attacks in August 2025**. This attack follows a pattern of targeting Japanese firms, with Asahi being the latest high-profile victim. The stolen data includes **both internal employee records and critical business intelligence**, raising concerns over **long-term financial, reputational, and competitive damage**. Asahi has not publicly confirmed or denied the ransom demands, but the operational halt underscores the **severe impact on core business functions**.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: In September 2025, Japan’s largest brewery, **Asahi Group Holdings**, fell victim to a **Qilin ransomware attack** that crippled its entire digital infrastructure over a weekend. By Monday, all **30 factories shut down**, halting production of flagship products like **Super Dry beer**. The attack locked every computer system, forcing employees to revert to **manual processes**—taking orders by phone, handwriting shipment instructions, and relying on **fax machines** to communicate with warehouses and distributors. Analysts projected an **83% domestic profit loss** if the outage persisted. While six breweries gradually restarted in early October, many systems remained unrecovered weeks later, with operations running primarily on **paper and fax**. The incident exposed critical vulnerabilities in digital dependency, as the company spent weeks rebuilding IT infrastructure from scratch while struggling to meet market demand and avoid reputational damage.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi Group Holdings, a major Japanese beer and beverage company, suffered a ransomware attack by the Qilin group, disrupting production across its six beer plants in Japan. The attack, first disclosed on **September 29**, forced a temporary halt in operations, with production resuming only on **October 2**. Qilin claimed responsibility on **October 1**, publishing **29 images** of allegedly stolen internal documents and asserting the theft of **over 9,300 files (27 GB)** of data. The group operates a **ransomware-as-a-service (RaaS)** model, extorting victims for financial gain. The incident remains under investigation, with Asahi declining to confirm the authenticity of the leaked data, extortion demands, or negotiations. Qilin, active since **2022**, has a history of high-profile attacks, including the **June 2024 breach of Synnovis**, a UK diagnostic services provider, which indirectly contributed to a patient’s death in **2025**. The Asahi attack highlights the growing threat of ransomware disrupting critical industrial operations, risking financial losses, reputational damage, and operational downtime.
Asahi Group Holdings
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Asahi Group Holdings, the Japanese beverage giant and producer of **Asahi Super Dry**, suffered a **ransomware attack** in late September 2024, disrupting its operations. The attack forced the company to **delay the release of its full-year financial results** (fiscal year ending December 2025) due to ongoing system recovery efforts. While **shipments are gradually resuming**, the incident caused **operational disruptions**, including potential delays in production and distribution. The attack was claimed by the **Qilin hacker group**, allegedly based in Russia, though Asahi has not confirmed the perpetrator’s identity or ransom demands. The incident highlights the growing threat of ransomware against high-profile corporations, with Asahi joining other global victims like **Jaguar Land Rover** (factory halts) and **Muji** (online service shutdowns). The financial and reputational impact remains significant, as the company works to restore systems while managing public trust and supply chain stability.
Asahi Group Holdings Ltd.
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Asahi Group Holdings Ltd., Japan’s largest beer brewer, suffered a ransomware attack by the Russian-speaking hacker group Qilin, which disrupted operations for over a week. The attack led to the theft of approximately **27 GB of data**, including **financial documents, contracts, development forecasts, and employees’ personal information**. The breach forced Asahi to **halt production at nearly 30 domestic factories**, crippling distribution and limiting orders to only its flagship *Asahi Super Dry* brew. While plants were gradually restored by mid-October, output remained below normal capacity. The stolen data was later found leaked online, though Asahi declined to confirm specifics. The incident caused supply chain disruptions, prompting competitors like Kirin, Sapporo, and Suntory to ramp up production to meet market demand. Qilin, known for **double-extortion tactics** (encrypting files and threatening to publish stolen data), has previously targeted over 100 companies globally, including a **$50M ransomware attack on UK hospital lab provider Synnovis** in 2024. The attack underscored Japan’s vulnerability to cyber threats, with ripple effects across factories, retailers, and restaurants.
AGH Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for AGH
Incidents vs Food and Beverage Services Industry Average (This Year)
Asahi Group Holdings has 2042.86% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Asahi Group Holdings has 1306.25% more incidents than the average of all companies with at least one recorded incident.
Incident Types AGH vs Food and Beverage Services Industry Avg (This Year)
Asahi Group Holdings reported 9 incidents this year: 1 cyber attacks, 8 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — AGH (X = Date, Y = Severity)
AGH cyber incidents detection timeline including parent company and subsidiaries
AGH Company Subsidiaries
Asahi Group Holdings, Ltd. is a global leader offering a diverse collection of brands centered on beer, alcohol and non-alcohol beverages, and food. Our mission is to deliver on our great taste promise and bring more fun to life. Established in Japan in 1889, the Group has always been committed to innovation and quality. This dedication has brought together iconic brands and the expertise of renowned breweries from around the world, including those with a rich heritage spanning over centuries. Our approach has culminated in a globally recognized portfolio of brands that includes premium beers such as Asahi Super Dry, Peroni Nastro Azzurro, Kozel, Pilsner Urquell, and Grolsch. “Make the world shine” articulates Asahi Group’s commitment to build connections among people, thereby paving the way for a sustainable future together. Through these connections, we can contribute to a brighter world, both today and in the future. With a global presence primarily in Japan and East Asia, Europe, Asia Pacific, we provide over 10 billion liters of beverages to consumers worldwide and generate revenues of over JPY 2.9 trillion annually. Headquartered in Japan, Asahi Group Holdings is listed on the Tokyo Stock Exchange (Prime Market: 2502.T). Must be legal drinking age to follow. Please share content with those who are of legal drinking age only.
Loading...
AGH Similar Companies
Uni-President Cor. Ltd.
Uni-President China Holdings Limited is the second largest tea, largest milk tea ready-to-drink, and the second largest instant noodle manufacturer and supplier in China. It is the Mainland China subsidiary of Uni-President Enterprises Corporation, the largest processed food producer in Taiwan. The
Nestlé
As the world’s largest food and beverage company we are driven by a simple aim: unlocking the power of food to enhance quality of life for everyone, today and for generations to come. To deliver on this, we serve with passion, with a spirit of excellence, offering products and services for all stage
We bottle and sell the beverages of The Coca-Cola Company exclusively in our 29 markets and partner with other beverage businesses to also sell their brands. With over 100 brands covering eight categories – sparkling, water, juices, ready-to-drink tea, energy, plant-based, premium spirits and coffee
UNFI
UNFI is North America’s Premier Food Wholesaler. We transform the world of food for our associates, customers, suppliers and the families we serve every day. With deeper full store selection and compelling brands for every aisle, built on an unmatched heritage in great food and fresh thinking. An
We are one of the leading global producers and exporters of quality food, as we believe it is fundamental to a better life for all people. Not only what we do, but the way we do it, is guided by the purpose of a better life for everyone, from farm to fork. That is why we conduct a sustainable mana
Tsingtao Brewery Co., Ltd
Tsingtao Brewery Co., Ltd. (hereinafter referred to as "Tsingtao Brewery") is a premium beer brewer founded in August 1903 by German and British businessmen in the city of Qingdao, China. In 1993, Tsingtao Brewery was listed both on the Hong Kong and Shanghai Stock Exchange. Today, our markets spa
Café de Coral Holdings Limited 大家樂集團
Incorporated in 1968 and listed on the Hong Kong Stock Exchange in July 1986, Café de Coral Group (SEHK: 0341) is one of Asia’s largest publicly-listed restaurant and catering groups. With deep roots in Hong Kong, the Group has established its position as a market leader in the fast food industry ov
PepsiCo is a playground for curious people. We invite thinkers, doers, and changemakers to champion innovation, take calculated risks, and challenge the status quo. From executives to team members on the front lines, we’re excited about the future. We take chances. Together, we dare to make the worl
Keurig Dr Pepper (KDP) is a leading beverage company in North America, with annual revenue in excess of $14.1 billion and nearly 28,000 employees. KDP holds leadership positions in soft drinks, specialty coffee and tea, water, juice and juice drinks and mixers, and markets the #1 single serve coffee
.png)
AGH CyberSecurity News
November 18, 2025 06:52 PM
Asahi cyberattack highlights risks to “operational technology”
Another type of cyber attack. Operations for Japan-based beverage giant Asahi Group Holdings recently shut down after a cyberattack,...
November 12, 2025 06:00 AM
Asahi Group's shipping volume has fallen to 10% of normal levels due to a cyber attack, leaving rival beer companies looking to grab market share.
On September 29, 2025, Asahi Group Holdings was hit by a cyber attack by the Russia-based cybercrime group Qilin .
November 06, 2025 10:43 PM
Blackwired unveils AI-powered upgrades to predict cyber-attacks
Blackwired launches AI-powered ThirdWatch upgrades to predict and prevent cyber-attacks, enhancing threat visualisation and intelligence for...
November 03, 2025 08:00 AM
Firms at risk as Japan struggles to keep up with cybercrime amid rise of ransomware
TOKYO -- Ransomware attacks targeting companies in Japan show no signs of abating, and the know-how for such attacks has already evolved...
October 31, 2025 07:00 AM
RansomHouse group claims responsibility for attack on Askul
A hacker group calling itself RansomHouse claimed responsibility for the cyberattack that crippled the operations of office supply...
October 29, 2025 07:00 AM
A month after Asahi cyberattack, Japan's beverage industry still high and dry
Brewer Asahi Group Holdings is still struggling to restore its operations one month after a cyberattack crippled its systems, with the...
October 28, 2025 07:00 AM
Asahi Halts Japan Production After Cyberattack
Asahi Group Holdings has shut down production at brewhouses in Japan following a cyberattack on core systems that has frozen orders,...
October 23, 2025 07:00 AM
ASEAN and Japan Unite Against Cyber Threats: the 2nd AJCCA Conference 2025 in Tokyo Highlights AI-Driven Defense and Regional Cooperation
TOKYO, Oct. 23, 2025 /PRNewswire/ -- As cyberattacks grow more complex and global supply chains face rising digital risks, leaders from...
October 23, 2025 03:34 AM
Japanese companies brace themselves for more attacks as cybercrimes climb
TOKYO – The recent wave of cyber attacks against Japanese businesses has exposed critical weaknesses in Japan's corporate digital defences, fuelling fears...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
AGH CyberSecurity History Information
Official Website of Asahi Group Holdings
The official website of Asahi Group Holdings is https://www.asahigroup-holdings.com/en/.
Asahi Group Holdings’s AI-Generated Cybersecurity Score
According to Rankiteo, Asahi Group Holdings’s AI-generated cybersecurity score is 100, reflecting their Critical security posture.
How many security badges does Asahi Group Holdings’ have ?
According to Rankiteo, Asahi Group Holdings currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Asahi Group Holdings have SOC 2 Type 1 certification ?
According to Rankiteo, Asahi Group Holdings is not certified under SOC 2 Type 1.
Does Asahi Group Holdings have SOC 2 Type 2 certification ?
According to Rankiteo, Asahi Group Holdings does not hold a SOC 2 Type 2 certification.
Does Asahi Group Holdings comply with GDPR ?
According to Rankiteo, Asahi Group Holdings is not listed as GDPR compliant.
Does Asahi Group Holdings have PCI DSS certification ?
According to Rankiteo, Asahi Group Holdings does not currently maintain PCI DSS compliance.
Does Asahi Group Holdings comply with HIPAA ?
According to Rankiteo, Asahi Group Holdings is not compliant with HIPAA regulations.
Does Asahi Group Holdings have ISO 27001 certification ?
According to Rankiteo,Asahi Group Holdings is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Asahi Group Holdings
Asahi Group Holdings operates primarily in the Food and Beverage Services industry.
Number of Employees at Asahi Group Holdings
Asahi Group Holdings employs approximately 1,129 people worldwide.
Subsidiaries Owned by Asahi Group Holdings
Asahi Group Holdings presently has no subsidiaries across any sectors.
Asahi Group Holdings’s LinkedIn Followers
Asahi Group Holdings’s official LinkedIn profile has approximately 202,985 followers.
NAICS Classification of Asahi Group Holdings
Asahi Group Holdings is classified under the NAICS code 722, which corresponds to Food Services and Drinking Places.
Asahi Group Holdings’s Presence on Crunchbase
No, Asahi Group Holdings does not have a profile on Crunchbase.
Asahi Group Holdings’s Presence on LinkedIn
Yes, Asahi Group Holdings maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/asahigroup-holdings.
Cybersecurity Incidents Involving Asahi Group Holdings
As of November 27, 2025, Rankiteo reports that Asahi Group Holdings has experienced 13 cybersecurity incidents.
Number of Peer and Competitor Companies
Asahi Group Holdings has an estimated 8,392 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Asahi Group Holdings ?
Incident Types: The types of cybersecurity incidents that have occurred include Ransomware and Cyber Attack.
What was the total financial impact of these incidents on Asahi Group Holdings ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $15 billion.
How does Asahi Group Holdings detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (investigation underway), and remediation measures with working to restore operations, and communication strategy with public statement issued (apology to customers/partners), and containment measures with fermeture des usines affectées, and communication strategy with conférence de presse du premier ministre shigeru ishiba (2025-07-21), and incident response plan activated with yes (manual order and shipping processes initiated), and recovery measures with manual order and shipping processes, and incident response plan activated with yes (under investigation), and remediation measures with restarted production at affected plants, and communication strategy with public disclosure via spokesperson statement, communication strategy with declined to comment on extortion details, and incident response plan activated with yes (it teams engaged in system rebuild), and containment measures with isolation of infected systems, containment measures with disconnection of digital networks, and remediation measures with manual order processing (fax/paper), remediation measures with in-person order collection, remediation measures with gradual system restoration, and recovery measures with rebuilding digital infrastructure from scratch, recovery measures with partial restart of 6 breweries by early october 2025, and communication strategy with public disclosure via media (e.g., the japan times), communication strategy with customer advisories on potential shortages, and incident response plan activated with yes (partial recovery ongoing), and containment measures with isolation of affected systems, containment measures with manual order processing, and remediation measures with system restoration from backups (assumed), and recovery measures with gradual resumption of production (by 2024-10-10), recovery measures with prioritization of key products (asahi super dry), recovery measures with expanded shipments from 2024-10-15, and communication strategy with public statement on 2024-10-09 (wednesday), communication strategy with spokesperson updates, communication strategy with no details on ransom negotiations, and law enforcement notified with historical: lockbit's 2024 takedown involved international law enforcement (servers, domains, decryption keys seized; lockbitsupp's identity revealed as dmitry yuryevich khoroshev), and and and containment measures with partial reopening of factories, containment measures with isolation of affected systems (likely), and remediation measures with manual order processing via pen/paper/fax, remediation measures with gradual restoration of it systems, and recovery measures with prioritizing shipments to larger customers, recovery measures with limited production resumption, and communication strategy with public apology for disruptions, communication strategy with updates via media (no direct timeline provided), and and containment measures with system shutdown (ordering, shipping, call centers), containment measures with isolation of affected systems, and remediation measures with investigation into data transfer, remediation measures with system restoration efforts, and recovery measures with manual order processing (temporary), recovery measures with brewery operations resumed, and communication strategy with public statements on attack and potential data theft, communication strategy with planned notifications to affected individuals if data breach confirmed, and recovery measures with manual order processing (temporary workaround), and incident response plan activated with yes (manual processing implemented), and containment measures with reversion to manual order processing (phone, fax, in-person), and and containment measures with system isolation, containment measures with restoration efforts, and remediation measures with system recovery in progress, and recovery measures with phased resumption of product shipments, and communication strategy with public statement by ceo atsushi katsuki, communication strategy with apology for inconvenience..
Incident Details
Can you provide details on each incident ?
Title: Cyberattack Disrupts Asahi's Order and Shipment Operations in Japan
Description: Japanese beverage company Asahi experienced a cyberattack causing a system failure that disrupted its ability to ship orders and manage its call center. The incident affected operations in Japan, including order and shipment processes, call center operations, and some customer service desks. Asahi reported no confirmed leakage of personal or customer data. The company is investigating the cause and working to restore operations, with no estimated recovery timeline. The attack is limited to Asahi's operations within Japan. No ransomware claim or attribution has been made as of the report.
Date Publicly Disclosed: 2025-MM-DD (exact date not specified; statement published on a Monday)
Type: Cyberattack (potential ransomware, unconfirmed)
Title: Cyberattaque par ransomware paralysant la production d'Asahi Super Dry au Japon
Description: Une attaque par ransomware a forcé Asahi Group Holdings, le géant brassicole japonais, à fermer la majorité de ses 30 usines nationales depuis le 21 juillet 2025, entraînant une pénurie imminente d'Asahi Super Dry, la bière la plus populaire du pays. Les systèmes de commande et de livraison ont été totalement désactivés, provoquant un arrêt quasi-total de la production sans date de reprise annoncée. Cette attaque s'inscrit dans une vague croissante de cybermenaces au Japon, exacerbée par des infrastructures informatiques obsolètes et un manque criant d'experts en cybersécurité (déficit estimé à 110 000 professionnels en 2025). Le gouvernement japonais a récemment adopté des lois de cyberdéfense active (entrée en vigueur prévue en 2026) pour contrer ces menaces, mais les critiques soulignent un retard structurel dans la modernisation des systèmes et la formation des talents.
Date Detected: 2025-07-21
Date Publicly Disclosed: 2025-07-21
Type: ransomware
Attack Vector: systèmes obsolètesmanque de mesures proactivespénurie d'experts en cybersécurité
Vulnerability Exploited: logiciels ancienssystèmes non modernisésfaible culture de cybersécurité
Motivation: perturbation opérationnellefinancière (potentielle)géopolitique (hypothèse non confirmée)
Title: Qilin Ransomware Attack on Asahi Group
Description: The Qilin ransomware group claimed responsibility for a cyber-attack on Japan’s Asahi Group, alleging the theft of 27 GB of sensitive data, including employee personal details, financial documents, budgets, contracts, plans, and development forecasts. The attack caused significant operational disruption, including the suspension of order and shipment operations, as well as call center services in Japan. Asahi is in the process of resuming operations with manual processes.
Date Publicly Disclosed: 2025-10-07
Type: ransomware
Threat Actor: Qilin ransomware group
Motivation: financial gain (ransomware-as-a-service)
Title: Qilin Ransomware Attack on Asahi Group Holdings Disrupts Beer Production
Description: Qilin, a ransomware group, claimed responsibility for a cyberattack on Japan's Asahi Group Holdings, disrupting production at its beer and beverage plants. The group posted 29 images of allegedly stolen internal documents and claimed to have exfiltrated over 9,300 files (27 GB). Asahi Breweries restarted production at its six Japanese beer plants on October 2, 2024, after the attack was first disclosed on September 29, 2024. The incident remains under investigation, with no confirmed details on extortion demands or negotiations.
Date Detected: 2024-09-29
Date Publicly Disclosed: 2024-09-29
Date Resolved: 2024-10-02
Type: ransomware
Threat Actor: Qilin (Ransomware-as-a-Service group)
Motivation: financial gainextortion
Title: Qilin Ransomware Attack on Asahi Group Holdings (2025)
Description: In September 2025, Japan's largest brewery, Asahi Group Holdings, was crippled by a ransomware attack from the Qilin group. The attack locked all computer systems, shutting down 30 factories and forcing the company to revert to manual processes, including fax machines and paper orders, for weeks. The incident caused significant operational disruptions, with an estimated 83% domestic profit hit if the outage persisted. Asahi gradually restored six breweries by early October, but many systems remained unrecovered. The attack highlighted the unintended resilience of analog systems like fax machines, which remained operational due to their separation from compromised digital networks.
Date Detected: 2025-09-01T00:00:00Z
Date Publicly Disclosed: 2025-10-04T00:00:00Z
Type: Ransomware
Attack Vector: Malicious File Download (likely phishing or compromised link)Network Encryption
Threat Actor: Qilin Ransomware Group
Motivation: Financial Gain (Ransom Demand)
Title: Ransomware Attack on Asahi Group Holdings Ltd. by Qilin Hacking Group
Description: A Russian-speaking hacker group known as Qilin claimed responsibility for a ransomware attack on Asahi Group Holdings Ltd., Japan's largest beer brewer. The attack disrupted operations for over a week, leading to production halts at roughly 30 domestic factories. The group stole approximately 27 GB of data, including financial documents, contracts, development forecasts, and employees' personal information. Asahi confirmed leaked information was found online but did not disclose further investigation details. Production is expected to resume partially by October 10 (Thursday), though output will remain below normal. Rival breweries (Kirin, Sapporo, Suntory) are compensating for shortages, with Suntory canceling limited-edition beer launches to prioritize mainstay products. Qilin, active since mid-2022, employs double-extortion tactics (encryption + data theft) and has targeted over 100 companies globally, including a $50M attack on UK's Synnovis in 2024.
Date Detected: 2024-09-29
Date Publicly Disclosed: 2024-09-29
Type: ransomware
Attack Vector: phishingexploiting vulnerabilitiesmalware deployment
Threat Actor: Qilin (Russian-speaking hacker group)
Motivation: financial gainextortion
Title: Collaboration of Ransomware-as-a-Service (RaaS) Groups: DragonForce, Qilin, and LockBit
Description: Ransomware-as-a-service (RaaS) groups DragonForce, Qilin, and LockBit announced a strategic collaboration to enhance their attack capabilities and market dominance. The partnership, proposed by DragonForce in early September 2025, aims to create a 'coalition' or 'cartel' to maximize income and avoid internal conflicts. The alliance follows LockBit's reemergence with its LockBit 5.0 variant and seeks to restore its reputation after a 2024 law enforcement takedown. While no joint attacks have been observed yet, the collaboration is expected to increase the frequency and effectiveness of ransomware attacks, potentially targeting critical infrastructure and low-risk sectors previously overlooked. Separately, another cybercrime collective (Scattered Spider, ShinyHunters, and Lapsus$ rebranded as 'Scattered Lapsus$ Hunters') launched a new data-leak site targeting 39 companies' Salesforce environments, claiming nearly 1 billion stolen records.
Date Detected: 2025-09-01
Date Publicly Disclosed: 2025-09-01
Type: Ransomware Collaboration
Threat Actor: DragonForceQilinLockBit
Motivation: Financial GainMarket DominanceReputation Restoration (LockBit)Collaborative Strength
Title: Cyber-Attack on Asahi Group Forcing Manual Operations and Supply Chain Disruptions
Description: Asahi Group, Japan's largest brewer and maker of Asahi Super Dry, suffered a cyber-attack in late May 2024 that disrupted production at 30 factories, including six breweries. The attack forced the company to revert to manual processes (pen, paper, and fax) for order processing and shipments, causing widespread shortages of beer, soft drinks, and other products across Japan. The ransomware group Qilin claimed responsibility, and Asahi confirmed data suspected to have been leaked was found online. Operations have partially resumed, but full recovery timelines remain unclear. The incident highlights Japan's vulnerability to cyber-attacks due to reliance on legacy systems and low digital literacy in business software.
Date Detected: Late May 2024
Date Publicly Disclosed: Early June 2024
Type: Ransomware Attack
Attack Vector: Phishing (suspected)Exploitation of Legacy SystemsRansomware-as-a-Service (RaaS)
Vulnerability Exploited: Legacy IT SystemsLow Digital Literacy in Business SoftwareLack of Cybersecurity Preparedness
Threat Actor: Qilin Ransomware Group
Motivation: Financial Gain (Extortion)
Title: Asahi Breweries Ransomware Attack and Data Breach
Description: Japanese beer giant Asahi suffered a ransomware attack on September 29, initially believed to have no data compromise. Later investigations revealed potential unauthorized transfer of personal and corporate data, including employee records, contracts, and financial data. The attack, claimed by the Qilin ransomware group, caused significant operational disruptions, including delays in shipments, stock shortages, and reliance on manual order processing (pen, paper, and fax). Financial reporting was also postponed due to system outages and inaccessible accounting data. The company is still assessing the full extent of the breach and has not confirmed whether personal data was definitively stolen.
Date Detected: 2023-09-29
Date Publicly Disclosed: 2023-09-29 (initial disclosure); 2023-10-XX (update on potential data theft)
Type: Ransomware Attack
Attack Vector: Ransomware (Qilin strain)
Threat Actor: Qilin ransomware group
Motivation: Financial gain (ransom demand), data theft
Title: Cyberattack and Potential Data Breach at Asahi Group Holdings
Description: Asahi Group Holdings, a Japanese food and beverage company, experienced a ransomware attack in October 2023. The hacker group Qilin claimed responsibility, stating it stole over 9,300 data files, including financial data and employee personal information. The attack disrupted operations, delaying earnings reports and forcing manual order processing. The company confirmed the potential breach of personal data on October 8, 2023.
Date Publicly Disclosed: 2023-10-08
Type: ransomware
Threat Actor: Qilin
Title: Cyberattack Cripples Asahi Group Holdings Ltd., Disrupting Supply Chain and Market Position
Description: A ransomware attack on Asahi Group Holdings Ltd. disabled its internal order and shipment system, forcing the company to revert to manual processing (in-person, phone, fax). The attack occurred during Japan's peak beer-drinking season (December), reducing shipments to 10% of normal levels. Competitors like Kirin, Suntory, and Sapporo capitalized on the disruption, replacing Asahi's dispensing units and gaining market share. The incident exposed vulnerabilities in Asahi's legacy systems, which were undergoing integration at the time. Financial losses include a projected ¥15 billion core operating loss for Q4, with full-year guidance expected to miss by 13%. The attack also disrupted gift pack sales, a key Japanese custom, and delayed Q3 earnings reporting indefinitely.
Date Publicly Disclosed: 2023-10-06
Type: Ransomware Attack
Vulnerability Exploited: Legacy system integration vulnerabilities during platform consolidation
Title: Ransomware Attack on Asahi Group Holdings
Description: Japanese beer giant Asahi Group Holdings, maker of Asahi Super Dry, was hit by a ransomware attack in late September 2025. The attack disrupted operations, delayed the release of full-year financial results, and caused partial shipment halts. The company is working to restore systems, with shipments resuming in stages. The hacker group Qilin, believed to be based in Russia, is suspected to be responsible.
Date Detected: 2025-09-29
Date Publicly Disclosed: 2025-09-29
Type: ransomware
Threat Actor: Qilin (suspected, Russia-based)
Motivation: financial (ransomware)
Title: Asahi Ransomware Breach and Ongoing Operational Disruptions
Description: Two months after a ransomware breach, Asahi's systems and supplies have not returned to normal. Retailers are running out of Asahi's products and are turning to competitors such as Kirin, Sapporo, and Suntory.
Type: ransomware
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Ransomware.
Impact of the Incidents
What was the impact of each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Data Compromised: None confirmed (as per Asahi's statement)
Systems Affected: Order and shipment systems (group companies in Japan)Call center operationsCustomer service desks
Downtime: Ongoing (no estimated recovery timeline)
Operational Impact: Suspended order/shipment operations, disrupted call center and customer service
Brand Reputation Impact: Potential negative impact due to service disruption (apology issued)
Identity Theft Risk: None confirmed
Payment Information Risk: None confirmed
Incident : ransomware ASA1092410100325
Systems Affected: systèmes de commandesystèmes de livraison30 usines nationales
Downtime: en cours (débuté le 2025-07-21, pas de date de fin annoncée)
Operational Impact: arrêt quasi-total de la production de bière Asahi Super Dry, pénurie nationale imminente
Customer Complaints: ire des consommateurs japonais (mentionnée)
Brand Reputation Impact: critiques envers la 'faillite des systèmes de sécurité informatique' au Japon
Incident : ransomware ASA2592025100725
Data Compromised: Employee personal details, Financial documents, Budgets, Contracts, Plans, Development forecasts
Systems Affected: serversorder and shipment systemscall center operations
Downtime: ongoing (partial recovery with manual processes)
Operational Impact: suspended order and shipment operationssuspended call center operations (customer service desks)
Brand Reputation Impact: potential negative impact due to data breach and operational disruption
Identity Theft Risk: high (employee personal details compromised)
Incident : ransomware ASA1362013100825
Data Compromised: Type: [, ', i, n, t, e, r, n, a, l, , d, o, c, u, m, e, n, t, s, ', ,, , ', c, o, r, p, o, r, a, t, e, , d, a, t, a, ', ], Volume: 2, 7, , G, B, , (, 9, ,, 3, 0, 0, +, , f, i, l, e, s, ),
Systems Affected: beer production plants (6 locations in Japan)
Downtime: 3 days (from 2024-09-29 to 2024-10-02)
Operational Impact: production halt at all six Japanese beer plants
Brand Reputation Impact: potential reputational damage due to public disclosure and operational disruption
Incident : Ransomware ASA3192031100825
Systems Affected: All computer systems30 factoriesDigital order processingSupply chain management
Downtime: ['Weeks (partial recovery by early October 2025)', '37+ days for full system restoration (estimated)']
Operational Impact: Complete shutdown of digital operationsManual order processing (paper/fax)In-person order collectionGradual restart of 6 breweries by early October83% potential domestic profit loss if outage continued
Customer Complaints: ['Potential Super Dry beer shortages reported by convenience stores']
Brand Reputation Impact: High (publicized operational collapse)Media coverage of analog fallback (fax/paper)
Incident : ransomware ASA2492424100825
Data Compromised: Financial documents, Contracts, Development forecasts, Employees' personal information
Systems Affected: production systemsdistribution networksorder processing
Downtime: >1 week (production halt at ~30 factories)
Operational Impact: manual order processing (phone-based)limited product shipments (only Asahi Super Dry initially)reduced output post-recoverysupply chain disruptions
Brand Reputation Impact: Potential damage due to production delays and data leak
Identity Theft Risk: High (employees' personal information exposed)
Incident : Ransomware Collaboration ASA1302113100925
Operational Impact: Potential surge in ransomware attacks on critical infrastructure and low-risk sectors
Brand Reputation Impact: LockBit seeks to restore reputation post-2024 takedown; potential reputational damage to targeted entities
Incident : Ransomware Attack ASA2162021101125
Systems Affected: Production Systems (30 factories, including 6 breweries)Order Processing SystemsShipment Logistics SystemsCommunication Systems (reverted to fax)
Downtime: ['Partial downtime ongoing as of early June 2024', 'Full recovery timeline unspecified']
Operational Impact: Manual processing of orders via pen/paper/faxReduced shipment capacity (10-20% of normal)Production halts at most facilitiesSupply chain disruptions for beer, soft drinks, and food items
Customer Complaints: True
Brand Reputation Impact: Short-term reputational damage due to product shortagesErosion of trust in digital resilience
Incident : Ransomware Attack ASA2692326101425
Data Compromised: Employee records, Contracts, Financial data, Forecasts, Personal documents (e.g., employee id cards)
Systems Affected: Ordering systemsShipping systemsCall center systemsAccounting/financial systems
Downtime: Ongoing as of latest update (at least 2 weeks since initial attack)
Operational Impact: Shipment delaysStock shortagesManual order processing (pen, paper, fax)Breweries operational but IT systems down
Brand Reputation Impact: Potential damage due to data breach and operational disruptions
Identity Theft Risk: High (if personal data confirmed stolen)
Incident : ransomware ASA2392123101525
Downtime: True
Operational Impact: Manual order processing; delayed earnings release (postponed from November 12, 2023)
Identity Theft Risk: Potential (employee personal information compromised)
Incident : Ransomware Attack ASA3932439111225
Financial Loss: Projected ¥15 billion core operating loss for Q4; full-year guidance expected to miss by 13%; higher marketing costs to win back customers
Systems Affected: Order and shipment processing systemFinancial data accessSupply chain operations
Downtime: Over one month (as of report date, ongoing)
Operational Impact: Shipments reduced to 10% of normal; manual processing (phone, fax, in-person) implemented; delayed Q3 earnings report; disrupted gift pack sales
Revenue Loss: Super Dry alone accounts for 12% of annual sales volume; December is strongest month
Customer Complaints: Bars and restaurants reported stockouts (e.g., Bier Reise ’98, Izakaya Ueno Ichiba Honten); gift pack shortages
Brand Reputation Impact: Lost No. 1 retail market position to Kirin; risk of long-term loyalty loss as competitors replace dispensing units and glassware
Incident : ransomware ASA5662456112725
Systems Affected: financial reporting systemssupply chain/logistics systems
Downtime: ongoing (as of disclosure, partial recovery in progress)
Operational Impact: delayed financial results, disrupted product shipments (resuming in stages)
Brand Reputation Impact: potential negative impact due to operational disruption
Incident : ransomware ASA5162551112725
Systems Affected: productionsupply chaindistribution
Downtime: 2+ months (ongoing)
Operational Impact: severe disruption in product availability, retailers switching to competitors (Kirin, Sapporo, Suntory)
Brand Reputation Impact: negative (loss of market share to competitors)
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $1.15 billion.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are None confirmed, Personal Details (Employees), Financial Documents, Budgets, Contracts, Plans, Development Forecasts, , Internal Documents, Corporate Files, , Financial Records, Contracts, Business Forecasts, Pii (Employees), , Corporate Data (Suspected), Potentially Customer/Partner Data (Unconfirmed), , Personal Information (Employee Records, Id Cards), Corporate Data (Contracts, Financial Data, Forecasts), , Financial Data, Employee Personal Information and .
Which entities were affected by each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Public Company
Industry: Beverage (Alcoholic & Non-Alcoholic)
Location: Japan
Size: Large (30+ factories in Japan, $9B+ revenue in H1 2025)
Incident : ransomware ASA1092410100325
Entity Name: Asahi Group Holdings
Entity Type: entreprise privée
Industry: brasserie/boissons
Location: Japon (30 usines nationales)
Size: grande entreprise (géant brassicole)
Customers Affected: consommateurs japonais (pénurie nationale d'Asahi Super Dry)
Incident : ransomware ASA2592025100725
Entity Name: Asahi Group
Entity Type: corporation
Industry: beverage (alcoholic and non-alcoholic), food products
Location: Tokyo, Japan
Size: large (global brands: Asahi, Peroni, Kozer, Pilsner Urquell, Grolsch, Fullers)
Incident : ransomware ASA1362013100825
Entity Name: Asahi Group Holdings
Entity Type: public company
Industry: beverage (beer and non-alcoholic drinks)
Location: Japan
Size: large enterprise
Incident : Ransomware ASA3192031100825
Entity Name: Asahi Group Holdings
Entity Type: Public Company
Industry: Beverage, Brewery, Food & Beverage
Location: Japan (HQ in Tokyo)Global operations
Size: Large (30+ factories, multinational)
Customers Affected: Retailers (e.g., convenience stores), Distributors, End consumers (potential beer shortages)
Incident : ransomware ASA2492424100825
Entity Name: Asahi Group Holdings Ltd.
Entity Type: Public Company
Industry: Beverage, Brewery, Food & Beverage
Location: Tokyo, Japan
Size: Large (global operations)
Customers Affected: retailers, restaurants, consumers (indirectly via shortages)
Incident : Ransomware Collaboration ASA1302113100925
Entity Name: Asahi Beer
Entity Type: Corporation
Industry: Beverage (Alcohol)
Incident : Ransomware Collaboration ASA1302113100925
Entity Name: 39 Unnamed Companies (via Salesforce environments)
Entity Type: Corporation, Organization
Incident : Ransomware Attack ASA2162021101125
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Public Company (Brewing & Beverages)
Industry: Food & Beverage, Alcohol, Consumer Goods
Location: Japan (primary impact; European subsidiaries unaffected)
Size: Large (40% market share in Japan's beer industry)
Customers Affected: Bars, Restaurants, Retailers, Convenience Stores (FamilyMart, 7-Eleven, Lawson), Wholesalers, End Consumers
Incident : Ransomware Attack ASA2162021101125
Entity Name: FamilyMart
Entity Type: Convenience Store Chain
Industry: Retail
Location: Japan
Size: Large
Customers Affected: Consumers (shortages of Famimaru bottled teas)
Incident : Ransomware Attack ASA2162021101125
Entity Name: 7-Eleven Japan
Entity Type: Convenience Store Chain
Industry: Retail
Location: Japan
Size: Large
Customers Affected: Consumers (halted shipments of Asahi products)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Lawson, Inc.
Entity Type: Convenience Store Chain
Industry: Retail
Location: Japan
Size: Large
Customers Affected: Consumers (expected shortages of Asahi products)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Ben Thai Restaurant (Sengawacho, Tokyo)
Entity Type: Small Business (Restaurant)
Industry: Hospitality
Location: Tokyo, Japan
Size: Small
Customers Affected: Dine-in customers (limited beer availability)
Incident : Ransomware Attack ASA2162021101125
Entity Name: Hisako Arisawa's Liquor Store
Entity Type: Small Business (Retail)
Industry: Alcohol Sales
Location: Tokyo, Japan
Size: Small
Customers Affected: Consumers (limited stock of Asahi Super Dry and soft drinks)
Incident : Ransomware Attack ASA2692326101425
Entity Name: Asahi Group Holdings, Ltd.
Entity Type: Public Company
Industry: Beverage (Brewery)
Location: Japan
Size: Large (global corporation)
Incident : ransomware ASA2392123101525
Entity Name: Asahi Group Holdings
Entity Type: Corporation
Industry: Food and Beverage
Location: Japan
Incident : Ransomware Attack ASA3932439111225
Entity Name: Asahi Group Holdings Ltd.
Entity Type: Public Company
Industry: Beverage (Brewery)
Location: Japan
Size: Large (46% of total revenue from Japan in 2023)
Customers Affected: Bars, restaurants, retailers, wholesalers, and end consumers (e.g., Bier Reise ’98, Izakaya Ueno Ichiba Honten, OK Corp., Seven & i Holdings, FamilyMart, Lawson, Isetan Mitsukoshi, Takashiyama)
Incident : Ransomware Attack ASA3932439111225
Entity Name: Bier Reise ’98
Entity Type: Bar
Industry: Hospitality
Location: Shimbashi, Tokyo, Japan
Size: Small Business
Customers Affected: Patrons (80% of sales previously from Asahi Maruefu)
Incident : Ransomware Attack ASA3932439111225
Entity Name: Izakaya Ueno Ichiba Honten
Entity Type: Restaurant
Industry: Hospitality
Location: Ueno, Tokyo, Japan
Size: Small/Medium Business
Incident : ransomware ASA5662456112725
Entity Name: Asahi Group Holdings
Entity Type: public company
Industry: beverage (alcohol/beer)
Location: Japan
Size: large enterprise
Incident : ransomware ASA5162551112725
Entity Name: Asahi Group Holdings
Entity Type: corporation
Industry: beverage (alcohol)
Location: Japan
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Incident Response Plan Activated: Yes (investigation underway)
Remediation Measures: Working to restore operations
Communication Strategy: Public statement issued (apology to customers/partners)
Incident : ransomware ASA1092410100325
Containment Measures: fermeture des usines affectées
Communication Strategy: conférence de presse du Premier ministre Shigeru Ishiba (2025-07-21)
Incident : ransomware ASA2592025100725
Incident Response Plan Activated: yes (manual order and shipping processes initiated)
Recovery Measures: manual order and shipping processes
Incident : ransomware ASA1362013100825
Incident Response Plan Activated: yes (under investigation)
Remediation Measures: restarted production at affected plants
Communication Strategy: public disclosure via spokesperson statementdeclined to comment on extortion details
Incident : Ransomware ASA3192031100825
Incident Response Plan Activated: Yes (IT teams engaged in system rebuild)
Containment Measures: Isolation of infected systemsDisconnection of digital networks
Remediation Measures: Manual order processing (fax/paper)In-person order collectionGradual system restoration
Recovery Measures: Rebuilding digital infrastructure from scratchPartial restart of 6 breweries by early October 2025
Communication Strategy: Public disclosure via media (e.g., The Japan Times)Customer advisories on potential shortages
Incident : ransomware ASA2492424100825
Incident Response Plan Activated: Yes (partial recovery ongoing)
Containment Measures: isolation of affected systemsmanual order processing
Remediation Measures: system restoration from backups (assumed)
Recovery Measures: gradual resumption of production (by 2024-10-10)prioritization of key products (Asahi Super Dry)expanded shipments from 2024-10-15
Communication Strategy: public statement on 2024-10-09 (Wednesday)spokesperson updatesno details on ransom negotiations
Incident : Ransomware Collaboration ASA1302113100925
Law Enforcement Notified: Historical: LockBit's 2024 takedown involved international law enforcement (servers, domains, decryption keys seized; LockBitSupp's identity revealed as Dmitry Yuryevich Khoroshev)
Incident : Ransomware Attack ASA2162021101125
Incident Response Plan Activated: True
Containment Measures: Partial reopening of factoriesIsolation of affected systems (likely)
Remediation Measures: Manual order processing via pen/paper/faxGradual restoration of IT systems
Recovery Measures: Prioritizing shipments to larger customersLimited production resumption
Communication Strategy: Public apology for disruptionsUpdates via media (no direct timeline provided)
Incident : Ransomware Attack ASA2692326101425
Incident Response Plan Activated: True
Containment Measures: System shutdown (ordering, shipping, call centers)Isolation of affected systems
Remediation Measures: Investigation into data transferSystem restoration efforts
Recovery Measures: Manual order processing (temporary)Brewery operations resumed
Communication Strategy: Public statements on attack and potential data theftPlanned notifications to affected individuals if data breach confirmed
Incident : ransomware ASA2392123101525
Recovery Measures: Manual order processing (temporary workaround)
Incident : Ransomware Attack ASA3932439111225
Incident Response Plan Activated: Yes (manual processing implemented)
Containment Measures: Reversion to manual order processing (phone, fax, in-person)
Incident : ransomware ASA5662456112725
Incident Response Plan Activated: True
Containment Measures: system isolationrestoration efforts
Remediation Measures: system recovery in progress
Recovery Measures: phased resumption of product shipments
Communication Strategy: public statement by CEO Atsushi Katsukiapology for inconvenience
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Yes (investigation underway), , , Yes (IT teams engaged in system rebuild), Yes (partial recovery ongoing), , , Yes (manual processing implemented), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Type of Data Compromised: None confirmed
Number of Records Exposed: 0 (as per statement)
Data Exfiltration: None confirmed
Personally Identifiable Information: None confirmed
Incident : ransomware ASA2592025100725
Type of Data Compromised: Personal details (employees), Financial documents, Budgets, Contracts, Plans, Development forecasts
Sensitivity of Data: high (includes personally identifiable and business-sensitive information)
Data Exfiltration: yes (27 GB of files stolen)
Personally Identifiable Information: yes (employee details)
Incident : ransomware ASA1362013100825
Type of Data Compromised: Internal documents, Corporate files
Number of Records Exposed: 9,300+ files
Data Exfiltration: yes (claimed by Qilin)
Incident : Ransomware ASA3192031100825
Data Encryption: Yes (ransomware encrypted all computer systems)
Incident : ransomware ASA2492424100825
Type of Data Compromised: Financial records, Contracts, Business forecasts, Pii (employees)
Sensitivity of Data: High (financial + personal data)
Data Exfiltration: Confirmed (27 GB leaked; screenshots published by Qilin)
Data Encryption: Yes (ransomware encryption)
File Types Exposed: documentsspreadsheetsdatabases (assumed)
Personally Identifiable Information: Yes (employees' data)
Incident : Ransomware Collaboration ASA1302113100925
Number of Records Exposed: Scattered Lapsus$ Hunters claim ~1 billion records (unverified)
Incident : Ransomware Attack ASA2162021101125
Type of Data Compromised: Corporate data (suspected), Potentially customer/partner data (unconfirmed)
Sensitivity of Data: Moderate (business operations data; no confirmation of PII exposure)
Data Encryption: ['Ransomware encryption of systems']
Incident : Ransomware Attack ASA2692326101425
Type of Data Compromised: Personal information (employee records, id cards), Corporate data (contracts, financial data, forecasts)
Sensitivity of Data: High (includes personally identifiable information and corporate financial data)
Data Exfiltration: Claimed by Qilin (27 GB of files allegedly stolen)
Data Encryption: Likely (ransomware attack)
File Types Exposed: Employee recordsContractsFinancial documentsID cardsForecasts
Personally Identifiable Information: Yes (employee ID cards and personal documents)
Incident : ransomware ASA2392123101525
Type of Data Compromised: Financial data, Employee personal information
Number of Records Exposed: Over 9,300 files
Sensitivity of Data: High (includes personal and financial data)
Incident : ransomware ASA5662456112725
Data Encryption: True
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Working to restore operations, restarted production at affected plants, , Manual order processing (fax/paper), In-person order collection, Gradual system restoration, , system restoration from backups (assumed), , Manual order processing via pen/paper/fax, Gradual restoration of IT systems, , Investigation into data transfer, System restoration efforts, , system recovery in progress, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by fermeture des usines affectées, , isolation of infected systems, disconnection of digital networks, , isolation of affected systems, manual order processing, , partial reopening of factories, isolation of affected systems (likely), , system shutdown (ordering, shipping, call centers), isolation of affected systems, , reversion to manual order processing (phone, fax, in-person), , system isolation, restoration efforts and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : ransomware ASA1092410100325
Data Encryption: systèmes de commande et livraison désactivés (hypothèse d'encryption)
Incident : ransomware ASA1362013100825
Ransomware Strain: Qilin
Data Exfiltration: yes (27 GB claimed)
Incident : Ransomware ASA3192031100825
Ransomware Strain: Qilin
Data Encryption: Yes (all computer systems locked)
Incident : ransomware ASA2492424100825
Ransom Paid: Unclear (no confirmation of payment or refusal)
Ransomware Strain: Qilin
Data Encryption: Yes
Data Exfiltration: Yes (double-extortion)
Incident : Ransomware Collaboration ASA1302113100925
Ransomware Strain: LockBit 5.0Potential future 'ShinySp1d3r RaaS' (by Scattered Lapsus$ Hunters)
Incident : Ransomware Attack ASA2162021101125
Ransomware Strain: Qilin
Data Encryption: True
Data Exfiltration: True
Incident : Ransomware Attack ASA2692326101425
Ransomware Strain: Qilin
Data Encryption: Yes
Data Exfiltration: Claimed (27 GB of files)
Incident : ransomware ASA2392123101525
Data Exfiltration: True
Incident : Ransomware Attack ASA3932439111225
Data Encryption: Yes (disabled internal order/shipment system)
Incident : ransomware ASA5662456112725
Data Encryption: True
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through manual order and shipping processes, , Rebuilding digital infrastructure from scratch, Partial restart of 6 breweries by early October 2025, , gradual resumption of production (by 2024-10-10), prioritization of key products (Asahi Super Dry), expanded shipments from 2024-10-15, , Prioritizing shipments to larger customers, Limited production resumption, , Manual order processing (temporary), Brewery operations resumed, , Manual order processing (temporary workaround), phased resumption of product shipments, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Ransomware Collaboration ASA1302113100925
Legal Actions: Historical: 2024 law enforcement action against LockBit (servers seized, identity revealed)
Incident : Ransomware Attack ASA2162021101125
Regulatory Notifications: Japanese government investigating under Active Cyber Defense Law (ACD)
Incident : Ransomware Attack ASA2692326101425
Regulatory Notifications: Company stated it will notify affected parties and comply with applicable personal data protection laws
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Historical: 2024 law enforcement action against LockBit (servers seized, identity revealed).
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : ransomware ASA1092410100325
Lessons Learned: Nécessité urgente de moderniser les systèmes informatiques obsolètes au Japon., Renforcement requis des investissements dans la cybersécurité et la formation des experts (déficit de 110 000 professionnels en 2025)., Transition d'une stratégie réactive à une cyberdéfense active (loi prévue pour 2026)., Collaboration internationale accrue (pressions des États-Unis pour améliorer la posture cybernétique).
Incident : Ransomware ASA3192031100825
Lessons Learned: Unintended resilience of analog systems (e.g., fax machines) during cyberattacks, Importance of maintaining fallback operational protocols, Vulnerability of digital-only workflows to ransomware disruptions, Need for robust incident response plans to accelerate recovery
Incident : Ransomware Collaboration ASA1302113100925
Lessons Learned: Collaboration among RaaS groups can amplify threat capabilities, targeting critical infrastructure and previously low-risk sectors. Law enforcement actions (e.g., LockBit takedown) may temporarily disrupt operations but fail to fully dismantle groups due to decentralized structures and affiliate mobility.
Incident : Ransomware Attack ASA2162021101125
Lessons Learned: Japan's reliance on legacy systems and low digital literacy increases vulnerability to cyber-attacks., Manual fallback processes (e.g., fax) are inefficient and disrupt modern supply chains., Ransomware-as-a-Service (RaaS) models enable less-skilled threat actors to target large organizations., Government intervention (e.g., ACD law) is critical but requires time to implement effectively.
Incident : Ransomware Attack ASA3932439111225
Lessons Learned: Legacy system integration during consolidation creates vulnerabilities; manual backup processes (e.g., fax) are insufficient for modern operations; competitor poaching of market share during downtime can have long-term brand loyalty impacts.
What recommendations were made to prevent future incidents ?
Incident : ransomware ASA1092410100325
Recommendations: Accélérer la mise en œuvre des lois de cyberdéfense active (prévues pour 2026)., Investir massivement dans la modernisation des infrastructures IT gouvernementales et industrielles., Développer des programmes de formation intensifs pour combler le déficit d'experts en cybersécurité (objectif : 50 000 certifiés d'ici 2030)., Adopter une approche proactive pour anticiper les cybermenaces (ex : contre-espionnage)., Renforcer la coopération public-privé pour partager les bonnes pratiques et les alertes en temps réel.Accélérer la mise en œuvre des lois de cyberdéfense active (prévues pour 2026)., Investir massivement dans la modernisation des infrastructures IT gouvernementales et industrielles., Développer des programmes de formation intensifs pour combler le déficit d'experts en cybersécurité (objectif : 50 000 certifiés d'ici 2030)., Adopter une approche proactive pour anticiper les cybermenaces (ex : contre-espionnage)., Renforcer la coopération public-privé pour partager les bonnes pratiques et les alertes en temps réel.Accélérer la mise en œuvre des lois de cyberdéfense active (prévues pour 2026)., Investir massivement dans la modernisation des infrastructures IT gouvernementales et industrielles., Développer des programmes de formation intensifs pour combler le déficit d'experts en cybersécurité (objectif : 50 000 certifiés d'ici 2030)., Adopter une approche proactive pour anticiper les cybermenaces (ex : contre-espionnage)., Renforcer la coopération public-privé pour partager les bonnes pratiques et les alertes en temps réel.Accélérer la mise en œuvre des lois de cyberdéfense active (prévues pour 2026)., Investir massivement dans la modernisation des infrastructures IT gouvernementales et industrielles., Développer des programmes de formation intensifs pour combler le déficit d'experts en cybersécurité (objectif : 50 000 certifiés d'ici 2030)., Adopter une approche proactive pour anticiper les cybermenaces (ex : contre-espionnage)., Renforcer la coopération public-privé pour partager les bonnes pratiques et les alertes en temps réel.Accélérer la mise en œuvre des lois de cyberdéfense active (prévues pour 2026)., Investir massivement dans la modernisation des infrastructures IT gouvernementales et industrielles., Développer des programmes de formation intensifs pour combler le déficit d'experts en cybersécurité (objectif : 50 000 certifiés d'ici 2030)., Adopter une approche proactive pour anticiper les cybermenaces (ex : contre-espionnage)., Renforcer la coopération public-privé pour partager les bonnes pratiques et les alertes en temps réel.
Incident : Ransomware ASA3192031100825
Recommendations: Implement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measureImplement hybrid (digital + analog) backup systems for critical operations, Enhance employee training on phishing/malicious file risks, Develop and test manual fallback procedures for cyber incident scenarios, Invest in network segmentation to limit ransomware spread, Evaluate legacy system retention as a potential resilience measure
Incident : Ransomware Collaboration ASA1302113100925
Recommendations: Monitor for joint operations by DragonForce, Qilin, and LockBit, especially in critical infrastructure sectors., Enhance defenses against social engineering (e.g., Scattered Lapsus$ Hunters' tactics) and RaaS-based attacks., Prepare for potential ransomware-as-a-service innovations (e.g., 'ShinySp1d3r RaaS')., Review third-party risk exposure (e.g., Salesforce environments targeted by Scattered Lapsus$ Hunters)., Strengthen incident response plans for multi-group cybercrime collaborations.Monitor for joint operations by DragonForce, Qilin, and LockBit, especially in critical infrastructure sectors., Enhance defenses against social engineering (e.g., Scattered Lapsus$ Hunters' tactics) and RaaS-based attacks., Prepare for potential ransomware-as-a-service innovations (e.g., 'ShinySp1d3r RaaS')., Review third-party risk exposure (e.g., Salesforce environments targeted by Scattered Lapsus$ Hunters)., Strengthen incident response plans for multi-group cybercrime collaborations.Monitor for joint operations by DragonForce, Qilin, and LockBit, especially in critical infrastructure sectors., Enhance defenses against social engineering (e.g., Scattered Lapsus$ Hunters' tactics) and RaaS-based attacks., Prepare for potential ransomware-as-a-service innovations (e.g., 'ShinySp1d3r RaaS')., Review third-party risk exposure (e.g., Salesforce environments targeted by Scattered Lapsus$ Hunters)., Strengthen incident response plans for multi-group cybercrime collaborations.Monitor for joint operations by DragonForce, Qilin, and LockBit, especially in critical infrastructure sectors., Enhance defenses against social engineering (e.g., Scattered Lapsus$ Hunters' tactics) and RaaS-based attacks., Prepare for potential ransomware-as-a-service innovations (e.g., 'ShinySp1d3r RaaS')., Review third-party risk exposure (e.g., Salesforce environments targeted by Scattered Lapsus$ Hunters)., Strengthen incident response plans for multi-group cybercrime collaborations.Monitor for joint operations by DragonForce, Qilin, and LockBit, especially in critical infrastructure sectors., Enhance defenses against social engineering (e.g., Scattered Lapsus$ Hunters' tactics) and RaaS-based attacks., Prepare for potential ransomware-as-a-service innovations (e.g., 'ShinySp1d3r RaaS')., Review third-party risk exposure (e.g., Salesforce environments targeted by Scattered Lapsus$ Hunters)., Strengthen incident response plans for multi-group cybercrime collaborations.
Incident : Ransomware Attack ASA2162021101125
Recommendations: Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.Accelerate digital transformation to replace legacy systems in Japanese businesses., Invest in cybersecurity training and hiring to address the shortage of professionals., Implement robust incident response plans with automated fallback systems (not manual)., Enhance public-private collaboration for threat intelligence sharing under ACD law., Prioritize supply chain resilience in cybersecurity strategies.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Nécessité urgente de moderniser les systèmes informatiques obsolètes au Japon.,Renforcement requis des investissements dans la cybersécurité et la formation des experts (déficit de 110 000 professionnels en 2025).,Transition d'une stratégie réactive à une cyberdéfense active (loi prévue pour 2026).,Collaboration internationale accrue (pressions des États-Unis pour améliorer la posture cybernétique).Unintended resilience of analog systems (e.g., fax machines) during cyberattacks,Importance of maintaining fallback operational protocols,Vulnerability of digital-only workflows to ransomware disruptions,Need for robust incident response plans to accelerate recoveryCollaboration among RaaS groups can amplify threat capabilities, targeting critical infrastructure and previously low-risk sectors. Law enforcement actions (e.g., LockBit takedown) may temporarily disrupt operations but fail to fully dismantle groups due to decentralized structures and affiliate mobility.Japan's reliance on legacy systems and low digital literacy increases vulnerability to cyber-attacks.,Manual fallback processes (e.g., fax) are inefficient and disrupt modern supply chains.,Ransomware-as-a-Service (RaaS) models enable less-skilled threat actors to target large organizations.,Government intervention (e.g., ACD law) is critical but requires time to implement effectively.Legacy system integration during consolidation creates vulnerabilities; manual backup processes (e.g., fax) are insufficient for modern operations; competitor poaching of market share during downtime can have long-term brand loyalty impacts.
References
Where can I find more information about each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Source: Asahi Group Holdings Statement
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Source: Media Report (unspecified)
Date Accessed: 2025-MM-DD (Tuesday morning, day after disclosure)
Incident : ransomware ASA1092410100325
Source: Akamai Technologies (rapport sur les attaques DDoS)
Date Accessed: fin 2024
Incident : ransomware ASA1092410100325
Source: ISC² et METI (ministère japonais de l’Économie, du Commerce et de l’Industrie)
Date Accessed: 2023 (données reprises en 2025)
Incident : ransomware ASA1092410100325
Source: Yomiuri Shimbun (propos d'un officiel américain)
Date Accessed: 2025-07
Incident : ransomware ASA1092410100325
Source: AFP (photo de Shigeru Ishiba)
Date Accessed: 2025-07-21
Incident : ransomware ASA2592025100725
Source: ZeroFox Q3 2025 Ransomware Roundup
Incident : ransomware ASA2592025100725
Source: NCC Group August 2025 Ransomware Report
Incident : ransomware ASA1362013100825
Source: Reuters
Incident : ransomware ASA1362013100825
Source: eCrime.ch (cybercrime research platform)
Incident : Ransomware ASA3192031100825
Source: PayPerFax Research Compilation
Incident : Ransomware ASA3192031100825
Source: ABNewswire
Incident : ransomware ASA2492424100825
Source: Bloomberg
Incident : ransomware ASA2492424100825
Source: Qilin's dark web blog
Incident : ransomware ASA2492424100825
Source: Asahi Group Holdings Ltd. public statement (2024-10-09)
Incident : Ransomware Collaboration ASA1302113100925
Source: The Register
Incident : Ransomware Collaboration ASA1302113100925
Source: ReliaQuest Q3 2025 Ransomware Report
Incident : Ransomware Collaboration ASA1302113100925
Source: vx-underground (malware collector)
Incident : Ransomware Collaboration ASA1302113100925
Source: Telegram (Scattered Lapsus$ Hunters announcement)
Incident : Ransomware Attack ASA2162021101125
Source: BBC News
URL: https://www.bbc.com/news/articles/cpv1v5d0v1xo
Date Accessed: June 2024
Incident : Ransomware Attack ASA2692326101425
Source: The Register
Incident : Ransomware Attack ASA2692326101425
Source: Asahi Group Holdings Public Statements
Incident : Ransomware Attack ASA2692326101425
Source: National Cyber Security Centre Report (mentioned in article)
Incident : ransomware ASA2392123101525
Source: News report (unspecified)
Incident : Ransomware Attack ASA3932439111225
Source: Bloomberg
URL: https://www.bloomberg.com
Date Accessed: 2025-11-12
Incident : Ransomware Attack ASA3932439111225
Source: Nikkei Inc.
Incident : ransomware ASA5662456112725
Source: AFP (Agence France-Presse)
Incident : ransomware ASA5662456112725
Source: Asahi Group Holdings public statement (September 29, 2025)
Incident : ransomware ASA5662456112725
Source: Japanese media reports on Qilin's claim of responsibility
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Asahi Group Holdings Statement, and Source: Media Report (unspecified)Date Accessed: 2025-MM-DD (Tuesday morning, day after disclosure), and Source: Teikoku DatabankDate Accessed: 2025-05, and Source: Akamai Technologies (rapport sur les attaques DDoS)Date Accessed: fin 2024, and Source: ISC² et METI (ministère japonais de l’Économie, du Commerce et de l’Industrie)Date Accessed: 2023 (données reprises en 2025), and Source: Yomiuri Shimbun (propos d'un officiel américain)Date Accessed: 2025-07, and Source: AFP (photo de Shigeru Ishiba)Date Accessed: 2025-07-21, and Source: ComparitechDate Accessed: 2025-10-07, and Source: ZeroFox Q3 2025 Ransomware Roundup, and Source: NCC Group August 2025 Ransomware Report, and Source: Reuters, and Source: eCrime.ch (cybercrime research platform), and Source: BloombergDate Accessed: 2025-10-08, and Source: The Japan TimesDate Accessed: 2025-10-04, and Source: PayPerFax Research CompilationUrl: https://payperfax.com, and Source: ABNewswireUrl: https://www.abnewswire.com/email_contact_us.php?pr=when-ransomware-hit-in-2025-japans-biggest-brewery-survived-on-fax-machines, and Source: Bloomberg, and Source: Qilin's dark web blog, and Source: Asahi Group Holdings Ltd. public statement (2024-10-09), and Source: The Register, and Source: ReliaQuest Q3 2025 Ransomware Report, and Source: vx-underground (malware collector), and Source: Telegram (Scattered Lapsus$ Hunters announcement), and Source: BBC NewsUrl: https://www.bbc.com/news/articles/cpv1v5d0v1xoDate Accessed: June 2024, and Source: ReutersDate Accessed: June 2024, and Source: AFP via Getty ImagesDate Accessed: June 2024, and Source: The Register, and Source: Asahi Group Holdings Public Statements, and Source: National Cyber Security Centre Report (mentioned in article), and Source: News report (unspecified), and Source: BloombergUrl: https://www.bloomberg.comDate Accessed: 2025-11-12, and Source: Nikkei Inc., and Source: AFP (Agence France-Presse), and Source: Asahi Group Holdings public statement (September 29, 2025), and Source: Japanese media reports on Qilin's claim of responsibility.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Investigation Status: Active (cause under investigation)
Incident : ransomware ASA1092410100325
Investigation Status: en cours (pas de détails publics sur l'avancement)
Incident : ransomware ASA2592025100725
Investigation Status: ongoing (Asahi has not responded to Qilin’s claims)
Incident : ransomware ASA1362013100825
Investigation Status: ongoing (as of 2024-10-01)
Incident : Ransomware ASA3192031100825
Investigation Status: Ongoing (as of October 2025)
Incident : ransomware ASA2492424100825
Investigation Status: Ongoing (no details disclosed)
Incident : Ransomware Collaboration ASA1302113100925
Investigation Status: Ongoing; no confirmed joint attacks by DragonForce/Qilin/LockBit as of report. Scattered Lapsus$ Hunters' data-leak site active with unverified claims.
Incident : Ransomware Attack ASA2162021101125
Investigation Status: Ongoing (Japanese government and Asahi internal investigation)
Incident : Ransomware Attack ASA2692326101425
Investigation Status: Ongoing (extent and detail of data affected still under investigation)
Incident : ransomware ASA2392123101525
Investigation Status: Ongoing (systems not yet restored as of the report)
Incident : Ransomware Attack ASA3932439111225
Investigation Status: Ongoing (as of report date)
Incident : ransomware ASA5662456112725
Investigation Status: ongoing
Incident : ransomware ASA5162551112725
Investigation Status: ongoing (systems not fully restored after 2 months)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public statement issued (apology to customers/partners), Conférence De Presse Du Premier Ministre Shigeru Ishiba (2025-07-21), Public Disclosure Via Spokesperson Statement, Declined To Comment On Extortion Details, Public Disclosure Via Media (E.G., The Japan Times), Customer Advisories On Potential Shortages, Public Statement On 2024-10-09 (Wednesday), Spokesperson Updates, No Details On Ransom Negotiations, Public Apology For Disruptions, Updates Via Media (No Direct Timeline Provided), Public Statements On Attack And Potential Data Theft, Planned Notifications To Affected Individuals If Data Breach Confirmed, Public Statement By Ceo Atsushi Katsuki and Apology For Inconvenience.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Cyberattack (potential ransomware, unconfirmed) ASA0393103093025
Stakeholder Advisories: Public apology issued to customers and business partners
Customer Advisories: Yes (statement warning of service disruptions)
Incident : ransomware ASA1092410100325
Customer Advisories: Aucune date de retour à la normale annoncée pour la production d'Asahi Super Dry.
Incident : Ransomware ASA3192031100825
Stakeholder Advisories: Public Statements On Operational Status, Warnings To Retailers/Customers About Potential Shortages.
Customer Advisories: Notifications about order delaysPotential product shortages (e.g., Super Dry beer)
Incident : ransomware ASA2492424100825
Stakeholder Advisories: Limited Public Updates Via Spokesperson.
Customer Advisories: Indirect communication via retailers/restaurants on product availability
Incident : Ransomware Collaboration ASA1302113100925
Customer Advisories: Salesforce statement: 'Salesforce will not engage, negotiate with, or pay any extortion demand.'
Incident : Ransomware Attack ASA2162021101125
Stakeholder Advisories: Apology Issued To Customers And Partners, No Detailed Advisory On Mitigation Steps.
Customer Advisories: Warnings of product shortages from Asahi and convenience store chains (FamilyMart, 7-Eleven, Lawson)
Incident : Ransomware Attack ASA2692326101425
Stakeholder Advisories: Company plans to notify affected individuals if data breach confirmed
Incident : ransomware ASA5662456112725
Stakeholder Advisories: Delay In Financial Results Announcement, Phased Resumption Of Shipments.
Customer Advisories: apology for inconveniencerequest for understanding during recovery
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Public apology issued to customers and business partners, Yes (statement warning of service disruptions), Aucune Date De Retour À La Normale Annoncée Pour La Production D'Asahi Super Dry., , Public Statements On Operational Status, Warnings To Retailers/Customers About Potential Shortages, Notifications About Order Delays, Potential Product Shortages (E.G., Super Dry Beer), , Limited Public Updates Via Spokesperson, Indirect Communication Via Retailers/Restaurants On Product Availability, , Salesforce statement: 'Salesforce will not engage, negotiate with, or pay any extortion demand.', Apology Issued To Customers And Partners, No Detailed Advisory On Mitigation Steps, Warnings Of Product Shortages From Asahi And Convenience Store Chains (Familymart, 7-Eleven, Lawson), , Company plans to notify affected individuals if data breach confirmed, Delay In Financial Results Announcement, Phased Resumption Of Shipments, Apology For Inconvenience, Request For Understanding During Recovery and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : ransomware ASA1092410100325
High Value Targets: Systèmes De Commande, Systèmes De Livraison,
Data Sold on Dark Web: Systèmes De Commande, Systèmes De Livraison,
Incident : ransomware ASA2592025100725
High Value Targets: Employee Data, Financial And Business Documents,
Data Sold on Dark Web: Employee Data, Financial And Business Documents,
Incident : Ransomware ASA3192031100825
High Value Targets: Computer Systems, Factory Operations, Supply Chain Management,
Data Sold on Dark Web: Computer Systems, Factory Operations, Supply Chain Management,
Incident : ransomware ASA2492424100825
High Value Targets: Financial Data, Employee Pii, Business Forecasts,
Data Sold on Dark Web: Financial Data, Employee Pii, Business Forecasts,
Incident : Ransomware Collaboration ASA1302113100925
High Value Targets: Critical Infrastructure (E.G., Nuclear Power Plants, Thermal/Hydroelectric Plants),
Data Sold on Dark Web: Critical Infrastructure (E.G., Nuclear Power Plants, Thermal/Hydroelectric Plants),
Incident : Ransomware Attack ASA2162021101125
High Value Targets: Production Systems, Order Processing Databases,
Data Sold on Dark Web: Production Systems, Order Processing Databases,
Incident : Ransomware Attack ASA2692326101425
High Value Targets: Employee Records, Financial Data, Corporate Contracts,
Data Sold on Dark Web: Employee Records, Financial Data, Corporate Contracts,
Incident : ransomware ASA2392123101525
High Value Targets: Financial Data, Employee Personal Information,
Data Sold on Dark Web: Financial Data, Employee Personal Information,
Incident : Ransomware Attack ASA3932439111225
High Value Targets: Order/Shipment System, Financial Data,
Data Sold on Dark Web: Order/Shipment System, Financial Data,
Incident : ransomware ASA5662456112725
High Value Targets: Financial Systems, Supply Chain Systems,
Data Sold on Dark Web: Financial Systems, Supply Chain Systems,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : ransomware ASA1092410100325
Root Causes: Utilisation De Systèmes Et Logiciels Obsolètes Dans Les Infrastructures Critiques., Manque D'Investissements Soutenus Dans La Modernisation It., Culture Réactive (Plutôt Que Proactive) En Matière De Cybersécurité., Pénurie Chronique D'Experts Qualifiés (110 000 Manquants En 2025)., Retard Dans L'Adoption De Mesures De Cyberdéfense Active (Loi Prévue Seulement Pour 2026).,
Corrective Actions: Adoption Récente De Lois De Cyberdéfense Active (2026) Pour Le Contre-Espionnage Et La Détection Précoce., Campagne Nationale De Formation Et D'Incitation Aux Carrières En Cybersécurité (Objectif : 50 000 Experts Certifiés D'Ici 2030)., Système D'Habilitations De Sécurité Nationale (Meti, Mai 2025) Pour Protéger Les Informations Sensibles., Doublement Prévu Des Spécialistes En Cybersécurité D'Ici 2030.,
Incident : Ransomware ASA3192031100825
Root Causes: Likely Initial Access Via Phishing Or Malicious File Download, Lack Of Network Segmentation To Contain Ransomware Spread, Over-Reliance On Digital Systems Without Tested Manual Fallbacks,
Corrective Actions: System Rebuild From Scratch, Partial Restoration Of Brewery Operations (6/30 Factories By Early October), Continued Reliance On Analog Systems (Fax/Paper) During Recovery,
Incident : Ransomware Collaboration ASA1302113100925
Root Causes: Decentralized Raas Affiliate Models Enable Rapid Reformation Post-Law Enforcement Actions., Lack Of International Coordination To Permanently Dismantle Cybercrime Groups., Financial Incentives Drive Collaboration Among Competing Threat Actors.,
Incident : Ransomware Attack ASA2162021101125
Root Causes: Over-Reliance On Legacy It Systems With Poor Security Controls., Insufficient Cybersecurity Workforce And Digital Literacy In Business Operations., Lack Of Preparedness For Ransomware Attacks (E.G., No Immediate Automated Fallbacks)., Cultural Trust In Systems Without Proportional Risk Management.,
Corrective Actions: Japanese Government'S Active Cyber Defense Law (Acd) Empowers Proactive Measures (E.G., Neutralizing Attacker Servers)., Asahi Likely Reviewing It Infrastructure Modernization And Cybersecurity Investments., Convenience Store Chains Diversifying Suppliers To Mitigate Single-Point Failures.,
Incident : Ransomware Attack ASA3932439111225
Root Causes: Vulnerabilities in legacy systems during integration; lack of resilient backup systems for order processing
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Adoption Récente De Lois De Cyberdéfense Active (2026) Pour Le Contre-Espionnage Et La Détection Précoce., Campagne Nationale De Formation Et D'Incitation Aux Carrières En Cybersécurité (Objectif : 50 000 Experts Certifiés D'Ici 2030)., Système D'Habilitations De Sécurité Nationale (Meti, Mai 2025) Pour Protéger Les Informations Sensibles., Doublement Prévu Des Spécialistes En Cybersécurité D'Ici 2030., , System Rebuild From Scratch, Partial Restoration Of Brewery Operations (6/30 Factories By Early October), Continued Reliance On Analog Systems (Fax/Paper) During Recovery, , Japanese Government'S Active Cyber Defense Law (Acd) Empowers Proactive Measures (E.G., Neutralizing Attacker Servers)., Asahi Likely Reviewing It Infrastructure Modernization And Cybersecurity Investments., Convenience Store Chains Diversifying Suppliers To Mitigate Single-Point Failures., .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Qilin ransomware group, Qilin (Ransomware-as-a-Service group), Qilin Ransomware Group, Qilin (Russian-speaking hacker group), DragonForceQilinLockBit, Qilin Ransomware Group, Qilin ransomware group, Qilin, Qilin (suspected and Russia-based).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2025-07-21.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-09-29.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2024-10-02.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was Projected ¥15 billion core operating loss for Q4; full-year guidance expected to miss by 13%; higher marketing costs to win back customers.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were None confirmed (as per Asahi's statement), employee personal details, financial documents, budgets, contracts, plans, development forecasts, Type: ['internal documents', 'corporate data'], Volume: 27 GB (9,300+ files), , Type: ['internal documents', 'corporate data'], Volume: 27 GB (9,300+ files), , financial documents, contracts, development forecasts, employees' personal information, , , Employee records, Contracts, Financial data, Forecasts, Personal documents (e.g., employee ID cards), and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Order and shipment systems (group companies in Japan)Call center operationsCustomer service desks and systèmes de commandesystèmes de livraison30 usines nationales and serversorder and shipment systemscall center operations and beer production plants (6 locations in Japan) and All computer systems30 factoriesDigital order processingSupply chain management and production systemsdistribution networksorder processing and Production Systems (30 factories, including 6 breweries)Order Processing SystemsShipment Logistics SystemsCommunication Systems (reverted to fax) and Ordering systemsShipping systemsCall center systemsAccounting/financial systems and and Order and shipment processing systemFinancial data accessSupply chain operations and financial reporting systemssupply chain/logistics systems and productionsupply chaindistribution.
Response to the Incidents
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were fermeture des usines affectées, Isolation of infected systemsDisconnection of digital networks, isolation of affected systemsmanual order processing, Partial reopening of factoriesIsolation of affected systems (likely), System shutdown (ordering, shipping, call centers)Isolation of affected systems, Reversion to manual order processing (phone, fax, in-person) and system isolationrestoration efforts.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Personal documents (e.g., employee ID cards), employees' personal information, employee personal details, Employee records, development forecasts, Contracts, Forecasts, plans, financial documents, None confirmed (as per Asahi's statement), contracts, Financial data and budgets.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 1.0B.
Ransomware Information
What was the highest ransom paid in a ransomware incident ?
Highest Ransom Paid: The highest ransom paid in a ransomware incident was Unclear (no confirmation of payment or refusal).
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Historical: 2024 law enforcement action against LockBit (servers seized, identity revealed).
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Government intervention (e.g., ACD law) is critical but requires time to implement effectively., Legacy system integration during consolidation creates vulnerabilities; manual backup processes (e.g., fax) are insufficient for modern operations; competitor poaching of market share during downtime can have long-term brand loyalty impacts.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement robust incident response plans with automated fallback systems (not manual)., Adopter une approche proactive pour anticiper les cybermenaces (ex : contre-espionnage)., Review third-party risk exposure (e.g., Salesforce environments targeted by Scattered Lapsus$ Hunters)., Accélérer la mise en œuvre des lois de cyberdéfense active (prévues pour 2026)., Développer des programmes de formation intensifs pour combler le déficit d'experts en cybersécurité (objectif : 50 000 certifiés d'ici 2030)., Invest in cybersecurity training and hiring to address the shortage of professionals., Develop and test manual fallback procedures for cyber incident scenarios, Accelerate digital transformation to replace legacy systems in Japanese businesses., Enhance defenses against social engineering (e.g., Scattered Lapsus$ Hunters' tactics) and RaaS-based attacks., Evaluate legacy system retention as a potential resilience measure, Prepare for potential ransomware-as-a-service innovations (e.g., 'ShinySp1d3r RaaS')., Prioritize supply chain resilience in cybersecurity strategies., Enhance public-private collaboration for threat intelligence sharing under ACD law., Enhance employee training on phishing/malicious file risks, Implement hybrid (digital + analog) backup systems for critical operations, Invest in network segmentation to limit ransomware spread, Renforcer la coopération public-privé pour partager les bonnes pratiques et les alertes en temps réel., Investir massivement dans la modernisation des infrastructures IT gouvernementales et industrielles., Monitor for joint operations by DragonForce, Qilin, and LockBit, especially in critical infrastructure sectors. and Strengthen incident response plans for multi-group cybercrime collaborations..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are NCC Group August 2025 Ransomware Report, AFP (Agence France-Presse), Asahi Group Holdings Ltd. public statement (2024-10-09), Asahi Group Holdings Statement, Asahi Group Holdings public statement (September 29, 2025), Comparitech, Telegram (Scattered Lapsus$ Hunters announcement), BBC News, vx-underground (malware collector), ABNewswire, Asahi Group Holdings Public Statements, AFP via Getty Images, ISC² et METI (ministère japonais de l’Économie, du Commerce et de l’Industrie), National Cyber Security Centre Report (mentioned in article), Akamai Technologies (rapport sur les attaques DDoS), Media Report (unspecified), The Register, eCrime.ch (cybercrime research platform), The Japan Times, ZeroFox Q3 2025 Ransomware Roundup, Qilin's dark web blog, ReliaQuest Q3 2025 Ransomware Report, Japanese media reports on Qilin's claim of responsibility, Yomiuri Shimbun (propos d'un officiel américain), Bloomberg, News report (unspecified), Teikoku Databank, PayPerFax Research Compilation, AFP (photo de Shigeru Ishiba), Reuters and Nikkei Inc..
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://payperfax.com, https://www.abnewswire.com/email_contact_us.php?pr=when-ransomware-hit-in-2025-japans-biggest-brewery-survived-on-fax-machines, https://www.bbc.com/news/articles/cpv1v5d0v1xo, https://www.bloomberg.com .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Active (cause under investigation).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Public apology issued to customers and business partners, Public statements on operational status, Warnings to retailers/customers about potential shortages, Limited public updates via spokesperson, Apology issued to customers and partners, No detailed advisory on mitigation steps, Company plans to notify affected individuals if data breach confirmed, delay in financial results announcement, phased resumption of shipments, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Yes (statement warning of service disruptions), Aucune date de retour à la normale annoncée pour la production d'Asahi Super Dry., Notifications about order delaysPotential product shortages (e.g., Super Dry beer), Indirect communication via retailers/restaurants on product availability, Salesforce statement: 'Salesforce will not engage, negotiate with, or pay any extortion demand.', Warnings of product shortages from Asahi and convenience store chains (FamilyMart, 7-Eleven, Lawson) and apology for inconveniencerequest for understanding during recovery.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Utilisation de systèmes et logiciels obsolètes dans les infrastructures critiques.Manque d'investissements soutenus dans la modernisation IT.Culture réactive (plutôt que proactive) en matière de cybersécurité.Pénurie chronique d'experts qualifiés (110 000 manquants en 2025).Retard dans l'adoption de mesures de cyberdéfense active (loi prévue seulement pour 2026)., Likely initial access via phishing or malicious file downloadLack of network segmentation to contain ransomware spreadOver-reliance on digital systems without tested manual fallbacks, Decentralized RaaS affiliate models enable rapid reformation post-law enforcement actions.Lack of international coordination to permanently dismantle cybercrime groups.Financial incentives drive collaboration among competing threat actors., Over-reliance on legacy IT systems with poor security controls.Insufficient cybersecurity workforce and digital literacy in business operations.Lack of preparedness for ransomware attacks (e.g., no immediate automated fallbacks).Cultural trust in systems without proportional risk management., Vulnerabilities in legacy systems during integration; lack of resilient backup systems for order processing.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Adoption récente de lois de cyberdéfense active (2026) pour le contre-espionnage et la détection précoce.Campagne nationale de formation et d'incitation aux carrières en cybersécurité (objectif : 50 000 experts certifiés d'ici 2030).Système d'habilitations de sécurité nationale (METI, mai 2025) pour protéger les informations sensibles.Doublement prévu des spécialistes en cybersécurité d'ici 2030., System rebuild from scratchPartial restoration of brewery operations (6/30 factories by early October)Continued reliance on analog systems (fax/paper) during recovery, Japanese government's Active Cyber Defense Law (ACD) empowers proactive measures (e.g., neutralizing attacker servers).Asahi likely reviewing IT infrastructure modernization and cybersecurity investments.Convenience store chains diversifying suppliers to mitigate single-point failures..
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=asahigroup-holdings' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
