Qilin ransomware disrupts Asahi operations, data exfiltration claimed

A ransomware group known as Qilin has claimed responsibility for a cyberattack that forced Japanese brewer Asahi Group Holdings to suspend operations at several domestic sites and disrupted order, shipment and call center functions, the company said after disclosing the incident at the end of September. Asahi reported the incident on September 29 and subsequently confirmed the intrusion involved ransomware and that investigators had found evidence of data exfiltration. The brewer began resuming production at its Japanese plants in early October while continuing to investigate the scope of the breach.

Qilin posted images on its leak site this week and said it had taken roughly 9,300 files, about 27 gigabytes of data, from Asahi. The group published 29 screenshots it described as internal documents, and claimed the stolen material included financial records, contracts, forecasts and employee information. Asahi has said the matter is under investigation and declined to provide detailed comment on the group’s claims, including whether negotiations or extortion demands had taken place.

The attack caused immediate operational disruption. Asahi temporarily halted production at six...