Asahi says more than 1.5m customers’ data leaked in cyber-attack

Japanese beer giant Asahi revealed on Thursday that a massive cyber-attack in September has potentially leaked the personal information of more than 1.5 million customers.

The drinks company published a statement on its investigation into the ransomware attack, which had crippled its operations across its factories in Japan and forced employees to take orders by pen and paper.

Asahi said it found that personal details of people who had contacted its customer service centres were likely exposed and that those affected would be notified soon.

The firm added that it would delay the release of its full-year financial results to focus on dealing with the fallout of the attack.

Asahi did not state the attacker’s identity or demands. Ransomware group Qilin – which has previously hacked other major firms – had claimed responsibility for the Asahi attack.

The beer maker said in its preliminary findings that it discovered a disruption at one of its data centres on 29 September.

It said that although the system was quickly isolated, investigators found the attacker had already infiltrated the network, encrypted its data and deployed ransomware – a virus that blocks access to files until a ransom is paid.

Some data in the affected computers, along with personal information stored in the hacked servers, were also exposed, said Asahi.

It includes personal details of 1.52 million customers, specifically their names, gender, addresses and contact information.

Data belonging to about 107,000 current and former employees and 168,000 family members of staff were also potentially leaked.

The name and contact details of 114,000 external contacts that had communicated with the firm were also linked.

Credit card details were not included in Asahi’s list of leaked data.

The company added that it has not confirmed any evidence of the data being released and that the impact of the attack is limited to systems managed in Japan.

The firm also owns big brands in Europe like Peroni and Fuller’s Brewery in the UK. Asahi has said that the operations of those firms have not been impacted by the cyber-attack.

The company said it spent nearly two months containing the attack and is now working to restore systems and reconfigure its network.

The outage resulted in drink shortages in shops across Japan. Asahi accounts for around 40% of the country’s beer market.

The shortage also affected Asahi’s soft drinks, such as ginger beer and soda water.

Shipments are also gradually resuming, said Atsushi Katsuki, the firm’s president and chief executive, who apologised for the difficulties caused by the disruption.

“We are making every effort to achieve full system restoration as quickly as possible, while implementing measures to prevent recurrence and strengthening information security across the group.”

Other global brands have also recently experienced similar cyber-attacks.

Jaguar Land Rover was forced to tap emergency funding after a major cyber-attack crippled operations at its British factories.