Asahi: how one ransomware attack stopped Japan's largest brewer cold
Six breweries down, orders reverting to pen, paper and fax, and a CEO who said upfront he'd never pay. Six months later, Asahi had put real numbers on what the Qilin ransomware attack actually cost — and still didn't know for certain how the attacker got in.
Background
Asahi Group Holdings is Japan's largest brewer, the maker of Asahi Super Dry. On the morning of September 29, 2025, systems across the company's operations started failing. Asahi first described it publicly as a "system failure" — then, the same day, corrected that to what it actually was: a cyberattack the company called "sophisticated and cunning." The ransomware gang Qilin claimed responsibility about a week later.
From one ransomware attack to a nationwide beer shortage
What actually happened
The attack hit operations directly: six of Asahi's Japan-based breweries went down, production of Super Dry and other labels stopped, and October 2025 product launches were postponed. Order and shipment processing reverted to manual pen, paper and fax handling for weeks.
Qilin claimed responsibility in early October, saying it had exfiltrated roughly 27GB of data. Asahi's CEO, Atsushi Katsuki, was direct about the company's response at a Tokyo press conference: "Even if we had a ransom demand, we would not have paid it." Asahi says it never communicated with the attacker at all.
Shipments of 16 products resumed on October 15 — but "resumed" didn't mean "recovered." Three weeks later, in early November, Asahi was still shipping at roughly 10% of normal volume. Full resumption across all products wasn't targeted until April 2026.
On November 26, 2025, Asahi's investigation confirmed personal data belonging to approximately 1.9 million people — names, addresses, gender, phone numbers and email addresses of customers and employees — had potentially been exposed. By March 2026, nine-month financial results put a number on the damage: about ¥5 billion (about $31M) in lost revenue and ¥2 billion (about $12.6M) in lost profit, directly attributed to the attack.
Root cause
- Qilin ransomware encrypted production and order-processing systems across all six of Asahi's Japan breweries starting September 29, 2025.
- Qilin claims to have exfiltrated approximately 27GB of data before encrypting systems; Asahi's own investigation separately confirmed personal data belonging to roughly 1.9 million customers and employees was potentially exposed.
- Asahi did not pay a ransom and did not communicate with the attacker at any point, per CEO Atsushi Katsuki's public statement.
- How the attacker first got in remains genuinely unresolved, even in competing analyses published well after the fact: one points to stolen credentials with no novel exploit involved, another to an exploited VPN device. Asahi itself has not disclosed the entry point. This case study presents both theories as unconfirmed and competing, not as a single likely answer.
- The 27GB exfiltration figure comes solely from Qilin's own claim of responsibility — a self-reported number from the attacker, not independently verified by Asahi or a third party.
Timeline
Detection
Asahi noticed systems failing across its operations on the morning of September 29, 2025, and initially described it publicly as a "system failure" before correcting that, the same day, to a confirmed cyberattack. Discovery came from the operational disruption itself — production and order-processing systems failing — not from a security alert catching an intrusion in progress.
Not disclosed. Asahi has not stated how long the attacker had access before systems were encrypted on September 29, 2025, and the initial access vector itself remains unconfirmed, so no reliable time-to-detect figure can be given.
- The initial access vector remains unconfirmed months later (stolen credentials in one analysis, an exploited VPN device in another), which means it isn't possible to say with confidence what earlier signal, if any, existed before encryption began.
- Qilin's claimed 27GB exfiltration happened before the encryption event that actually alerted Asahi, meaning the data-theft phase itself produced no detected alarm on its own.
What to monitor for in your own environment
Anomalous large-volume outbound data transfer from production or order-processing systems ahead of any encryption activity
Network egress / DLP logsAuthentication from an unfamiliar credential or remote-access session on a VPN device or production system
VPN and remote-access authentication logsMass file-modification activity consistent with ransomware staging, across multiple brewery sites nearly simultaneously
Endpoint and file-integrity monitoring across all six sitesContainment, eradication & recovery
Containment
Sept 29, 2025- Took affected production and order-processing systems offline across all six Japan breweries the same day, reverting to manual pen, paper and fax handling.
- Declined to communicate with or pay the attacker at any point, per CEO Katsuki's public statement.
Eradication
Not fully disclosed- Specific technical eradication steps (credential rotation, patching, environment rebuild) have not been disclosed by Asahi; since the initial access vector itself remains unconfirmed, this case study does not assume what was done to close it rather than invent a plausible-sounding account.
- Systems were restored to a sufficiently operational state to resume partial shipping by October 15, 2025, which is the one confirmed marker of eradication progress.
Recovery
Oct 15, 2025 – Apr 2026- Resumed shipping 16 products on October 15, 2025, though at roughly 10% of normal volume three weeks later in early November.
- Filed data-exposure investigation findings confirming data on about 1.9 million people by November 26, 2025.
- Disclosed full financial impact (¥5B revenue, ¥2B profit lost) in nine-month results by March 2026, with full product-line resumption targeted for April 2026.
Security control analysis
Neither Asahi nor independent researchers have confirmed the actual entry point months after the attack — credential theft and an exploited VPN device are both cited as possibilities. Any verdict beyond "unknown" would be speculation.
The pen-and-paper fallback existed and kept some orders moving, but shipment volume was still only about 10% of normal three weeks after systems "resumed" — it functioned, but nowhere near full operational capacity.
CEO Katsuki stated plainly and publicly that Asahi never communicated with the attacker and would not have paid. That's a clear, accountable decision stated in the open, not an ambiguous internal policy.
Asahi's investigation confirmed and filed the scope of the data exposure by November 26, 2025 — under two months after the attack — rather than slow-walking disclosure while the picture was still forming.
Qilin claims to have pulled data out before encrypting systems, and Asahi's own investigation separately confirmed personal data on roughly 1.9 million people was potentially exposed — whatever controls existed didn't stop exfiltration ahead of the encryption event.
By March 2026, Asahi disclosed specific, verifiable financial figures (¥5B revenue, ¥2B profit) rather than vague "material impact" language, giving a real basis for judging the scale of the disruption.
Controls that would have prevented or limited this
Removes stolen-credential-only access as a viable path in, regardless of which initial-access theory is correct.
Limits what an exploited VPN device alone could reach, even if that turns out to be the actual entry point.
Would have surfaced the gap between "shipments resumed" and only 10% of normal volume before a real incident exposed it to customers.
Would have surfaced the data exfiltration Qilin claims happened before encryption, rather than learning about it solely from the attacker's own claim.
Blast radius
What was hit
- Production and order-processing systems at all six Japan breweries
- Personal data of roughly 1.9 million customers and employees — names, addresses, gender, phone numbers, emails
- Shipment volume — down to about 10% of normal three weeks after "resuming"
What Asahi held the line on
- No ransom paid, and no communication with the attacker at all, per CEO Katsuki
- Regulatory disclosure filed within two months, not slow-walked
- Full, specific financial impact figures disclosed rather than vague "material impact" language
Resuming shipments did not mean recovering volume
What they got right
CEO Katsuki stated plainly, in public, that Asahi never communicated with the attacker and would not have paid a ransom — a concrete commitment the company could be held to, rather than leaving the question open to speculation.
Asahi filed its investigation findings with Japan's privacy regulator by November 26, 2025 — under two months after the attack — rather than slow-walking disclosure while the full picture was still forming.
By March 2026, Asahi disclosed specific, verifiable financial figures (¥5B revenue, ¥2B profit) instead of vague "material impact" language, giving customers, investors and regulators something concrete to evaluate.
Why this keeps happening
Qilin was reportedly the most active ransomware-as-a-service operation of 2025, with over 100 confirmed attacks and hundreds more claimed. A RaaS model means the same playbook runs against many targets in parallel, by different affiliates, which is exactly why a single group's name keeps reappearing across unrelated victims in unrelated industries.
Even months later, security researchers still don't agree on Asahi's actual entry point — credential theft in one analysis, an exploited VPN device in another. When the initial access vector can't be pinned down with confidence even in hindsight, it's a reminder that detection built around "knowing how they got in" is building on sand.
The six-week gap between "shipments resumed" (Oct 15) and still-at-10%-volume (early November) is a pattern that shows up across ransomware recoveries generally: restoring a system is not the same as restoring the business process that depends on it.
Lessons for your own environment
- Manual fallback processes need to actually work, not just exist on paper
Asahi reverted to pen, paper and fax orders for weeks. An organization that hasn't rehearsed its manual fallback recently often discovers it barely functions under real volume — by the time it's needed.
- Resuming operations and recovering them are different claims
Shipments resumed October 15, but volume was still about 10% of normal three weeks later. Report recovery in terms customers and investors can actually verify, not just a binary "back online."
- A no-ransom policy is only credible stated out loud
Katsuki's direct public statement gave customers, investors and regulators a concrete commitment to hold the company to, instead of leaving the question to speculation and rumor.
- Disclose real figures, not "material impact"
Vague breach disclosures protect no one. Specific numbers — ¥5B revenue, ¥2B profit — let customers, investors and regulators actually judge the scale of what happened.
- The entry point may never be fully confirmed — plan for that
Security researchers still disagree, months on, about exactly how the attacker got in. Build detection and response that doesn't depend on knowing the entry point in advance.
- A six-plant blast radius breaks a single-site DR plan
All six of Asahi's Japan breweries were affected at once, not just one site. A disaster-recovery plan built around losing a single facility doesn't match what this attack actually did.
CISO & board lessons
- A six-site simultaneous outage is a different board conversation than a single-facility DR plan implies. If your continuity planning assumes losing one site at a time, this incident is a reason to re-model for a correlated, multi-site failure.
- Ask finance and operations, jointly, to define what "recovered" actually means in measurable terms before the next incident — not during one. Asahi's gap between "shipments resumed" and "volume restored" is exactly the kind of ambiguity that erodes trust with the board and the market if it isn't defined in advance.
- A public, unambiguous no-ransom commitment from the CEO is a governance decision, not just a PR line — it removes an entire category of pressure and second-guessing during the incident itself, because the answer was already decided before anyone was negotiating under duress.
- Budget conversations about detection and forensic readiness should account for the real possibility that the entry point may never be fully confirmed. A security program built entirely around "we'll know how they got in and fix that one thing" is planning for a cleaner outcome than this incident, and many others, actually deliver.
Action plan
First 24 hours
- If ransomware activity is confirmed, isolate affected production and order-processing systems at every site simultaneously, not just the first one discovered — a single-site response can miss a correlated, multi-site event.
- Activate manual fallback processes immediately and assign a named owner to track their real throughput against normal volume, not just whether they're "running."
- Make and publicly state the ransom-payment decision early, at the executive level, rather than leaving it open during active negotiation pressure.
First 7 days
- Stand up parallel investigation tracks for initial access and data exfiltration scope — don't let an inconclusive initial-access finding delay disclosure of what data was actually taken.
- Define, in writing, what "recovery" will be measured against (shipment volume, order throughput, system uptime) before any public statement claims operations have "resumed."
- Begin regulatory and customer notification processes on the data actually confirmed exposed, even if the full initial-access picture isn't resolved yet.
First 30 days
- Publish specific, verifiable financial and operational impact figures once available, rather than qualitative "material impact" language.
- Run a full post-incident review assuming the entry point may never be confirmed with certainty, and harden detection and segmentation accordingly rather than waiting on a definitive root-cause answer.
- Rehearse the manual fallback process at realistic multi-week volume, not just as a tabletop exercise, given how far short of normal capacity it ran here.
Could this happen in your organization?
- If every one of your production or operational sites went down simultaneously, not just one, does your disaster-recovery plan actually cover that scenario?
- Could your organization run its manual fallback process for weeks, at real order volume, or does it only work as a short-term stopgap?
- Has your leadership already decided, before any incident, whether the organization will pay a ransom — or would that decision be made for the first time under pressure?
- Do you have a defined, measurable definition of "recovered" (volume, throughput, error rate) that would prevent a partial restart from being reported as a full recovery?
- Could your organization confidently name its own initial-access vector after a breach, or would you be in the same position Asahi is in months later — genuinely unsure?
- How quickly could you confirm and disclose the scope of data exposure even if the initial-access investigation is still inconclusive?
- Would your public communications commit to specific, verifiable figures, or default to vague "material impact" language that tells stakeholders little?
If this happened to you: what to ask, and what to say
Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.
- "If our order-processing systems went down right now, could we actually run the manual fallback — today, not in theory?"Ask for a real walkthrough, not a confirmation. Asahi's pen-and-paper fallback existed, but running it for weeks at scale is a different test than having a plan on file.
- "What would 'resumed but not recovered' look like in our own metrics?"Define the actual recovery metric (volume, throughput, error rate) in advance, so a partial restart isn't quietly reported as a full recovery.
- "Could we confidently name our own entry point if this happened to us?"Asahi still can't, months later. If your logging and forensic readiness wouldn't answer this either, that's worth fixing before an incident, not during one.
- "Do we have a single-site DR plan that assumes only one facility goes down?"Six breweries went down together here. Check whether your own disaster-recovery assumptions match a multi-site simultaneous failure, not just a single outage.
- Say what happened, in one plain sentence.A board member should hear the operational reality, not a euphemism."Ransomware encrypted systems across all six of our production sites, forcing us to manual order processing for several weeks while we rebuilt and investigated."
- State the ransom decision plainly, and why.Ambiguity here invites speculation that's worse than the truth."We did not pay a ransom and did not communicate with the attacker at any point. We made that decision immediately and have not reconsidered it."
- Give the real financial number, not a qualitative description.A specific figure is more credible than "significant impact," and it's what investors will ask for regardless."We attribute approximately ¥5 billion in lost revenue and ¥2 billion in lost profit directly to this incident, based on our nine-month results."
- Be honest about what you still don't know.Months later, the entry point itself may remain unconfirmed — say so rather than imply false certainty."We have not been able to confirm the precise initial access method with certainty, and we are continuing to work with external investigators on this."
- Name the actual data involved, not a vague category."Certain information" tells a customer nothing useful."Data that may have been affected includes your name, address, gender, phone number and email address. It does not include payment card details."
- Explain the delay honestly, if there was one.If product availability was disrupted, say why in plain terms rather than leaving customers guessing."Order processing was disrupted by a cyberattack, which affected product availability for several weeks while we worked to restore operations safely."
- Confirm what's back to normal, and what isn't yet.A partial recovery reported as a full one erodes trust the moment someone notices otherwise."Shipping has resumed for a majority of our products. Full availability across our full range is targeted for [date], and we will update you if that changes."
- Warn them plainly about scams that follow a breach like this.High-profile breach disclosures reliably draw copycat phishing within days."We will never contact you asking for account details or payment information in connection with this incident. Treat any message that does as fraudulent."
References & confidence
- ConfirmedTechRepublic — Asahi cyberattack investigation coverage
- ConfirmedCyberInsider — Asahi says Qilin ransomware attack exposed data of 1.5–1.9 million people — Exposure-count range as reported; this case study uses Asahi's own later-confirmed about 1.9 million figure.
- ReportedManageEngine — analysis of the Asahi Super Dry attack's operational impact
- ConfirmedThe Star (Malaysia, via wire reporting) — Asahi not engaging with hackers after cyberattack — Sources the CEO's public no-ransom statement.
- ConfirmedITPro — impact of the Asahi cyberattack and confirmed exposure figures
- ConfirmedFoodNavigator-Asia — Asahi profit dips after Japan cyberattack — Sources the ¥5B/¥2B financial impact figures from Asahi's own disclosed results.
- ReportedNippon.com — Asahi logistics normalization timeline
- ReportedQilin's own claim of responsibility and the about 27GB exfiltration figure — Self-reported by the attacker; not independently verified.
- DisputedCybelangel and Criminal IP — competing analyses of the likely initial access vector (stolen credentials vs. exploited VPN device) — Two independent analyses point to different, unconfirmed initial-access theories; Asahi has not confirmed either.