Asahi Group Holdings headquarters building (center left), Sumida Ward, Tokyo.
Asahi Group Holdings confirmed that ransomware caused the cyberattack disrupting its operations since late September 2025. The incident has led to widespread supply shortages at convenience stores and restaurant chains across Japan.
Ransomware Attack Confirmed
Asahi's system outage began on September 29, halting order processing and shipments. On October 3, the company confirmed its servers had been infected with ransomware. Traces suggested a possible data leak, though the scope and content are still under investigation.
"As a precaution, we have isolated the affected systems to protect customer and partner data," the company said. "While this has caused disruptions to our domestic operations, we are prioritizing product supply and have begun limited manual order processing and shipments."
An emergency task force, launched on the day of the attack, is working with external cybersecurity experts to restore systems. Email communication with outside parties remains suspended.
Production and Distribution Disrupted
The ransomware crippled Asahi's order and distribution systems. In turn, this led to production halts at several factories. Shipments of major products, including Asahi Super Dry beer and bottled beverages, were interrupted.
Convenience store chains have reported empty shelves, while restaurant operators are scrambling to secure alternative supplies. The disruptions have rippled through Japan's retail and food service sectors as the company works to restore operations.
Empty Convenience Store Shelves
FamilyMart said shipments of its private-brand bottled tea and other beverages, co-developed and produced with Asahi, have also been suspended. The company warned that some stores may face shortages and empty shelves in the coming days.
Shipments of Clear Cooler, a chu-hi beverage co-developed with Seven-Eleven Japan, have also been suspended. Lawson reported that certain products could become scarce after October 3 and said it is preparing substitute items to minimize the impact.
The disruption extends beyond private-label drinks. Shipments of Asahi's flagship beers, canned chu-hi (canned cocktails), and food products have also been affected. All three major convenience store chains plan to offset shortages by sourcing alternative products where possible.
Restaurant Chains Shift to Other Brewers
Beyond retail, the disruption has spread to Japan's restaurant sector. At Marugen Ramen, which operates about 230 outlets nationwide, shipments of draft and bottled beer from Asahi have stopped. The chain plans to turn to other suppliers once its remaining stock runs out.
Kisoji, known for its shabu-shabu and traditional Japanese cuisine, is also adapting. It has switched from draft to bottled beer and is sourcing from other brewers to keep its service running.
Gradual Restart of Beer Production
In a follow-up on October 6, Asahi announced it had resumed operations at all six of its domestic beer plants — located in Sapporo, Motomiya (Fukushima), Moriya (Ibaraki), Nagoya, Suita (Osaka), and Hakata (Fukuoka). Production and shipments of Asahi Super Dry have restarted on a limited basis, with orders processed manually by phone.
President and Group CEO Atsushi Katsuki apologized for the disruption in a statement released on October 3.
"We deeply regret the inconvenience caused to our customers and partners," he said. "We are doing everything possible to restore our systems quickly while maintaining product supply through alternative measures."
The company is still assessing the financial impact on its fiscal year ending December 2025. It confirmed that the cyberattack's effects are confined to domestic operations.
RELATED:
- EDITORIAL | JAXA Hacking Risks Not Just Japan But Its Security Partners
- Ransomware Attack on KADOKAWA an Anomaly?
(Read related articles here and here in Japanese.)
Author: The Sankei Shimbun
