Asahi Group Holdings

Asahi Group Holdings, a major Japanese beer and beverage company, suffered a ransomware attack by the Qilin group, disrupting production across its six beer plants in Japan. The attack, first disclosed on September 29, forced a temporary halt in operations, with production resuming only on October 2. Qilin claimed responsibility on October 1, publishing 29 images of allegedly stolen internal documents and asserting the theft of over 9,300 files (27 GB) of data. The group operates a ransomware-as-a-service (RaaS) model, extorting victims for financial gain. The incident remains under investigation, with Asahi declining to confirm the authenticity of the leaked data, extortion demands, or negotiations. Qilin, active since 2022, has a history of high-profile attacks, including the June 2024 breach of Synnovis, a UK diagnostic services provider, which indirectly contributed to a patient’s death in 2025. The Asahi attack highlights the growing threat of ransomware disrupting critical industrial operations, risking financial losses, reputational damage, and operational downtime.

Source: https://www.asahi.com/ajw/articles/16077955

TPRM report: https://www.rankiteo.com/company/asahigroup-holdings

"id": "asa1362013100825",
"linkid": "asahigroup-holdings",
"type": "Ransomware",
"date": "6/2022",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'beverage (beer and non-alcoholic drinks)',
                        'location': 'Japan',
                        'name': 'Asahi Group Holdings',
                        'size': 'large enterprise',
                        'type': 'public company'}],
 'data_breach': {'data_exfiltration': 'yes (claimed by Qilin)',
                 'number_of_records_exposed': '9,300+ files',
                 'type_of_data_compromised': ['internal documents',
                                              'corporate files']},
 'date_detected': '2024-09-29',
 'date_publicly_disclosed': '2024-09-29',
 'date_resolved': '2024-10-02',
 'description': 'Qilin, a ransomware group, claimed responsibility for a '
                "cyberattack on Japan's Asahi Group Holdings, disrupting "
                'production at its beer and beverage plants. The group posted '
                '29 images of allegedly stolen internal documents and claimed '
                'to have exfiltrated over 9,300 files (27 GB). Asahi Breweries '
                'restarted production at its six Japanese beer plants on '
                'October 2, 2024, after the attack was first disclosed on '
                'September 29, 2024. The incident remains under investigation, '
                'with no confirmed details on extortion demands or '
                'negotiations.',
 'impact': {'brand_reputation_impact': 'potential reputational damage due to '
                                       'public disclosure and operational '
                                       'disruption',
            'data_compromised': {'type': ['internal documents',
                                          'corporate data'],
                                 'volume': '27 GB (9,300+ files)'},
            'downtime': '3 days (from 2024-09-29 to 2024-10-02)',
            'operational_impact': 'production halt at all six Japanese beer '
                                  'plants',
            'systems_affected': ['beer production plants (6 locations in '
                                 'Japan)']},
 'investigation_status': 'ongoing (as of 2024-10-01)',
 'motivation': ['financial gain', 'extortion'],
 'ransomware': {'data_exfiltration': 'yes (27 GB claimed)',
                'ransomware_strain': 'Qilin'},
 'references': [{'source': 'Reuters'},
                {'source': 'eCrime.ch (cybercrime research platform)'}],
 'response': {'communication_strategy': ['public disclosure via spokesperson '
                                         'statement',
                                         'declined to comment on extortion '
                                         'details'],
              'incident_response_plan_activated': 'yes (under investigation)',
              'remediation_measures': ['restarted production at affected '
                                       'plants']},
 'threat_actor': 'Qilin (Ransomware-as-a-Service group)',
 'title': 'Qilin Ransomware Attack on Asahi Group Holdings Disrupts Beer '
          'Production',
 'type': ['ransomware', 'data breach', 'operational disruption']}