On 29 September, Asahi Group Holdings experienced disruptions to order processing, shipping and its customer call centre in Japan. The ransomware group Qilin later published the leaked data. The leak is reportedly claimed to comprise approximately 9,323 records and approximately 27GB.
On 29 September, Asahi Group Holdings confirmed that order processing, shipping operations and its customer call centre in Japan had been affected. At the time of the announcement, no evidence of personal data leakage had been confirmed, but it was subsequently reported that the ransomware group Qilin, which led the attack, had published the data. The leaked data is reportedly said to total 9,323 records and approximately 27GB.
The published files reportedly contained confidential information, including financial records, copies of identification documents, contracts, tax-related documents and business forecasts. In addition to losses from business disruption, the possibility of legal risks has also been highlighted.
The technology director of Acronis’s Threat Research Unit (TRU) commented that the incident would test how cyber risks have previously been understood and the importance of business continuity planning in practice. Although the method of compromise has not been identified, phishing, theft of credentials and exploitation of unpatched vulnerabilities are among the possibilities being considered. Defence in depth and the establishment of response arrangements during normal operations are considered essential, and the incident has been described as once again demonstrating the importance of layered security measures.