Asahi breach exposes more than 1.5 million customers’ details
Delays release of full-year results
Asahi, the Japanese beer brand that owns others including Peroni and Fuller’s Brewery, has revealed that a cyberattack has exposed more than 1.5 million customers’ personal information.
The attack stemmed from an incident at an Asahi datacentre on 29th September, when ransomware was injected into the company network.
That attack also exposed personal data stored in the datacentre’s servers, although it doesn’t seem to have been the primary target.
Nevertheless, Asahi says about 1.52 million people who contacted its customer service centres may have had their name, gender, address, phone number and email address exposed.
Other groups’ data was also leaked, including 114,000 external contacts; 107,000 employees; and 168,000 employees’ family members.
Although there is still only one confirmed case of data exposure – involving 18 pieces of employee-related personal information stored on company laptops - Asahi plans to notify all of those potentially affected soon.
Ransomware cripples Asahi’s operations
According to Asahi’s own investigation, the disruption began at 7am JST on 29th September. The attacker appears to have gained gained unauthorised access to the network through network equipment located at Asahi’s site, taking the opportunity to deploy ransomware and encrypt multiple devices.
Asahi disconnected the network at 11am the same day and implemented measures to isolate the datacentre. However, by that point the damage was done; operations across Japan were affected, including order placement and shipments.
Employees were forced to turn to manual, paper-based systems to ensure product supply to customers continued. Factories returned to their normal operations slowly through October.
Russian gang Qilin previously claimed responsibility for the cyberattack, posting multiple samples of data allegedly stolen from the Japanese drinks giant.
Asahi has decided to delay announcing its full-year results for the year ending 31st December 2025, and expects to share them more than 50 days later.
Operations outside Japan were not affected by the incident, but Asahi still faces a long, slow climb back to full operations: it doesn’t expect to return to normal until February.
Kevin Marriott, senior manager of cyber at Immersive, said:
“Manufacturing networks are complex ecosystems, potentially containing legacy systems, shadow IT, diverse technologies and connectivity with supply chains and other third-party entities. As a result, when impacted, full recovery is a timely process, especially when assuring all artifacts of compromise have been identified and removed, which is likely why it is likely to be February before a return to normalised operations is achieved.”
Jaguar Land Rover, which was also affected by a massive cyberattack this year, was in a similar position: the manufacturer closed production at the end of July and couldn’t resume operations for more than a month.