Asahi Group: ransomware attack
Ransomware halted domestic ordering and shipping on 29 September 2025. Entry through group-site network equipment began about ten days earlier; the exact date is unknown. Qilin claimed responsibility. The 17 July 2026 reassessment separately listed possible exposure of about 1,525,000 customer-service records, 117,000 telegram-contact records, 107,000 employee/retiree records, 162,000 family records and 378,000 business-partner records. February's confirmed leaks comprised 5,117 business-partner and 110,396 employee-related records, with employee records also included in the possible-exposure scope. These groups are not added as unique people. Logistics normalized by February 2026; no ransom was paid.
Disclosed
2025-09-29
Organizations involved
1
Leaked or at risk
1.5M
1,525,000
Downtime
Unknown
Timeline
- Detected, Disclosed 2025-09-29
- 1 days
Attack or cause
- Method
- [Ransomware][Intrusion]
- Impact
- [Service outage][Data leak][Extortion]
- Entry point
- Unknown
- Actor
- Qilin Ransomware group · Claimed
- Ransom
- Demanded · Paid: No
Data exposed or at risk
Organizations involved
[Breached][Critical]Tokyo, SumidaManufacturing1,525,000 leaked
Asahi Group Holdings, Ltd.
Sources
- [1][Official]サイバー攻撃被害の再発防止策とガバナンス体制の強化についてAsahi Group Holdings, Ltd. · 2026-02-18
- [2][Official]Regarding Personal Information That May Have Been Exposed Due to a CyberattackAsahi Group Holdings, Ltd. · 2026-07-17
- [3][News]アサヒ、サイバー攻撃「異変は10日前から」。社長が語った2カ月の攻防。Business Insider Japan · 2025-11-27
- [4][News]Asahi beverage group confirms 110,000 personal data records leakedThe Straits Times / Kyodo News · 2026-02-18
- [5][News]アサヒ、勝木社長がシステム障害を陳謝 個人情報191万件が流出かThe Asahi Shimbun · 2025-11-27
- [6][Research]アサヒGHDを攻撃したQilinランサムウェアグループの一般的なTTPCybertrust · 2025-11-06