Cybercrime crew claims attack on Japanese brewer as it restarts operations

The Russian-speaking ransomware group known as Qilin has claimed responsibility for a cyberattack that disrupted operations at Japanese beverage giant Asahi for several days, forcing production halts and delaying product launches across the country.

The hackers said they stole Asahi’s financial records, employee data, contracts and development forecasts, and they posted screenshots of those alleged documents on their leak site on Tuesday. 

Recorded Future News could not verify the authenticity of the alleged data, and Asahi has not commented on the claims or on whether it is in contact with the attackers.

Asahi, one of Japan’s largest beverage producers and the maker of the popular Super Dry beer, said last week that a ransomware incident had interrupted its order processing, shipping, and customer services. The company said it had found signs of a possible data leak and was investigating.

On Monday, its beer-making arm, Asahi Breweries, announced that it had restarted production at all six of its domestic plants and resumed shipments of Super Dry. It did not specify when full operations would resume.

Qilin, first identified in 2022, runs a ransomware-as-a-service operation, renting out its malware to affiliated groups in exchange for a share of ransom payments. The gang has previously targeted hospitals, government agencies, and private companies.

The group’s attack on London-based pathology service Synnovis last June severely disrupted care at numerous hospitals and healthcare providers in the city, and reportedly contributed to a patient’s death. Qilin had also previously targeted a prominent cancer hospital in Japan, forcing it to suspend some medical examinations and checkup services.

Cybersecurity experts infiltrated the group’s systems in 2023 and found ransom demands amounting to millions of dollars.