CasesS=1:500S=1:100
Asahi Group ransomware attack: the way in and the timeline
An external attacker entered through network equipment at one of the group's sites; the type of equipment has not been disclosed.
1 Summary
At about 07:00 on September 29, 2025, Asahi's systems failed and encrypted files were found. At about 11:00 the company cut the network and isolated the data center. Order and shipping systems in Japan stopped, and containment, restoration and hardening took about two months. Up to about 1.9 million personal records may have been exposed.
Probable cause: An external attacker entered through network equipment at one of the group's sites; the type of equipment has not been disclosed.
Source: Asahi Group Holdings 「サイバー攻撃被害の再発防止策とガバナンス体制の強化について」
Asahi says "network equipment at a Group site" and has not disclosed the type. Its prevention plan abolishes remote-access VPN appliances; that is a remedy, not a statement of the entry device.
S=1:100 2 Factual information
2.1 The way in
The company: about ten days before the outage, "an external attacker entered the Asahi Group network via network equipment located at a site within the Asahi Group."
Source: Asahi Group Holdings 「サイバー攻撃被害の再発防止策とガバナンス体制の強化について」
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
The attacker reached the data center network through the site's network equipment, and ransomware ran on several servers at once. Data on some PCs was taken. The company paused the backup system to protect the backup data and restored from it after checking it.
2.3 Damage
Order and shipping systems stopped and work was handled by hand. Containment, restoration and hardening took about two months. The company listed four groups of people whose data may have been exposed: 1.525 million customer-service contacts, 114,000 gift recipients, 107,000 employees including former ones, and 168,000 family members. As of February 18, 2026, the company had confirmed leaks of 5,117 employee records and 110,396 records of business-partner contacts.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| c. 2025-09 | Intruder | About ten days before the outage: entry via network equipment at a group site. | Asahi Group Holdings |
| c. 2025-09-29 07:00 | Company | System failure; encrypted files found. | Asahi Group Holdings |
| c. 2025-09-29 11:00 | Company | Network cut and data center isolated. | Asahi Group Holdings |
| 2025-11-27 | Company | Investigation results published. | Asahi Group Holdings |
| 2026-02-18 | Company | Prevention measures published, including abolishing remote-access VPN appliances. | Asahi Group Holdings |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Entry was through network equipment at a group site, about ten days before the outage. | Stated | Asahi Group Holdings |
| The device type, the site, the exact date, and whether a vulnerability or credentials were used. | Unknown | Asahi Group Holdings |
S=1:100 4 Conclusions
The company states that an external attacker entered through network equipment at a group site about ten days before the outage and that ransomware then ran across the data center. It has not said what the equipment was.
S=1:100 5 Recommendations
Recommended or carried out by: Company
- Abolish remote-access VPN appliances entirely, to prevent re-entry from network equipment.
- Redesign communication paths and network control, and tighten connection limits.
- Review security monitoring to detect attacks more accurately.
- Redesign the backup strategy and business-continuity plan.
Source: Asahi Group Holdings 「サイバー攻撃被害の再発防止策とガバナンス体制の強化について」Asahi Group Holdings 「サイバー攻撃による情報漏えいに関する調査結果と今後の対応について」
Sources
Source: Asahi Group Holdings 「サイバー攻撃による情報漏えいに関する調査結果と今後の対応について」Asahi Group Holdings 「サイバー攻撃被害の再発防止策とガバナンス体制の強化について」