Asahi's ransomware attack: the attacker was inside ten days earlier

Asahi Group says an external attacker entered its network through equipment at a Group site about ten days before ransomware hit on 29 September 2025. The attacker reached the main data center, exploited a password weakness to gain administrator rights and probed servers, mostly after business hours. The warning signs were there for days.

What Asahi reported

Asahi's investigation notes say it detected a system disruption around 7:00 a.m. JST on 29 September, found encrypted files, and disconnected the network and isolated the data center at about 11:00 a.m. that day. Ransomware encrypted data on multiple active servers and some PCs.

The company's later release says the attacker had been searching and probing multiple servers, mostly outside business hours, before deploying the ransomware. Impact was limited to systems managed in Japan.

The exposure numbers

The November 2025 report lists personal information that was exposed or possibly exposed. These include 1,525,000 customer service contacts, 114,000 people who had been sent congratulatory or condolence telegrams, 107,000 employees including retirees, and 168,000 family members of employees. Credit card information was not included. Asahi says it had not confirmed that any data had been published online.

Recovery took months

Asahi's February 2026 release states that order placement and shipment through its electronic ordering system resumed on 2 December 2025 for the foods business and 3 December for the breweries and soft drinks businesses. It says logistics had normalised by February 2026 and that it planned to widen the range of items shipped.

What ten days of dwell time tells you

1. Detection is the best place to win. Ransomware is the last step of a long intrusion. The days before it, with admin account use at odd hours and probing across servers, are the chance to stop it.
2. After hours matters. Alerts on privileged logins and broad server access outside working hours are cheap to write.
3. Edge equipment is a front door. The first foothold was network equipment, so inventory and patch it like servers.
4. One weak password can end segmentation. Asahi says a password weakness gave administrator privileges.
5. Isolation worked and cost a lot. Asahi disconnected VPNs, inter-site networks and the internet to contain the attack. Decide in advance who may order that.

A short detection checklist

1. List which accounts have domain administrator rights, and alert on first time use from a new device.
2. Alert on new admin accounts and on login bursts across many servers.
3. Log and review remote access and edge device sign-ins.
4. Keep offline or immutable backups, and test restoring them.
5. Practice the call to disconnect.

For what Asahi changed afterwards, see Asahi's rebuild checklist.

Where Safeguard fits

Safeguard focuses on software supply chain, code and compliance, not network intrusion detection or EDR. Its asset discovery helps you keep the inventory that detection depends on. A free scan is at gold.safeguard.sh/scan.

Quick check

Sources

• Asahi Group, Investigation results and future measures on cyberattack data exposure, 27 November 2025
• Asahi Group, Measures to prevent recurrence, 18 February 2026

Last reviewed: 19 October 2026.