# Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it) · pwn.watch

> A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.

Page: https://pwn.watch/i/asahi-ransomware-qilin-september-2025 · generated 2026-10-22T23:13:41.393Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Asahi Group Holdings (Japan operations)
- Started: 2025-09-29 · closed: 2025-10-15
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/asahi-ransomware-qilin-september-2025/feed.xml
- JSON Feed: https://pwn.watch/i/asahi-ransomware-qilin-september-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/asahi-ransomware-qilin-september-2025.json
- This file: https://pwn.watch/i/asahi-ransomware-qilin-september-2025/llms.txt

## Updates (newest first)
- 2025-10-07: Qilin claims responsibility and leaks data (https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-asahi-brewery-attack-leaks-data/)
- 2025-10-03: Asahi confirms ransomware and possible data exfiltration (https://www.asahigroup-holdings.com/en/newsroom/detail/20251003-0204.html)
- 2025-09-29: Cyberattack halts orders, shipments and call centres in Japan (https://www.bloomberg.com/news/articles/2025-09-29/cyberattack-disrupts-asahi-group-suspending-some-shipments)

## Fix brief
# Security brief: Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)

Source: https://pwn.watch/i/asahi-ransomware-qilin-september-2025 · status: closed (closed Oct 15, 2025) · severity: high · updated Oct 15, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.

Severity detail: Ransomware; nationwide shipment disruption

- Product: Asahi Group Holdings (Japan operations)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 7, 2025: Qilin claims responsibility and leaks data
- Oct 3, 2025: Asahi confirms ransomware and possible data exfiltration
- Sep 29, 2025: Cyberattack halts orders, shipments and call centres in Japan

## Advisories
- [Update on System Disruption Due to Cyberattack (2nd)](https://www.asahigroup-holdings.com/en/newsroom/detail/20251003-0204.html) (Asahi Group Holdings)

## Write-ups & news
- [Asahi Suspends Some Beverage Shipments After Hit by Cyberattack](https://www.bloomberg.com/news/articles/2025-09-29/cyberattack-disrupts-asahi-group-suspending-some-shipments)
- [Qilin ransomware claims Asahi brewery attack, leaks data](https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-asahi-brewery-attack-leaks-data/)
- [Ransomware Gang Qilin Claims Hack That Hit Beermaker Asahi](https://www.bloomberg.com/news/articles/2025-10-08/ransomware-gang-qilin-claims-hack-that-crippled-beermaker-asahi)

## Caveats
closedAt approximates partial recovery of shipments; full system recovery took longer.

---
Machine-readable: https://pwn.watch/i/asahi-ransomware-qilin-september-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.