Asahi mulls new cybersecurity unit as disruption drags on

TOKYO: Asahi Group Holdings Ltd is considering to create a new cybersecurity team after disruptions to operations and financial reporting from a September ransomware attack are expected to continue into the new year.

As part of recovery efforts, Japan’s largest beer maker is adopting what CEO Atsushi Katsuki called a stricter “zero-trust” approach – where the company assumes nobody inside its network is safe.

Asahi has already scrapped the use of virtual private networks, or VPNs, that help disguise a user’s location, Katsuki said in an interview on Friday.

“Information security is a management issue that should be given the highest priority,” he said. “We thought we had taken sufficient measures, which were easily broken. It made me realise there’s no limit to the precautions that can be taken.”

The cyberattack froze Asahi’s core business systems in Japan, forcing it to move orders and shipments offline. Deliveries of year-end gift sets, a seasonal staple in Japan, were delayed, and November beer and other alcohol sales plunged more than 20% compared with the previous year.

The event also shines a light on Japan’s broader vulnerability to cyber threats. The nation’s new cyber chief has warned that corporate defenses still lag behind the US and Europe, calling for urgent improvements across industries.

That concern was underscored by the recent ransomware attack on Askul Corp, which disrupted the online business of Muji and other retailers, showing how breaches are spreading beyond manufacturing into consumer-facing sectors.

Katsuki said the setback won’t threaten Asahi’s foundation and expressed confidence in regaining market share. He expects systems to be largely restored by February, with shelf space recovery and full competitive positioning returning from March onwards.

Before the breach, Asahi had forecast operating profit to fall 5.2% to ¥255 billion (US$1.6 billion) for the year ending December, on sales of ¥2.95 trillion.

The attack has caused a significant delay to financial disclosure, with annual results now expected more than 50 days late. Third-quarter figures were partially released in November.

Katsuki declined to set a new date for the earnings release but said Asahi plans to outline its growth strategy – particularly in non- and low-alcohol beverages and its investment plan, once reporting resumes.

The scale of the incident has underscored that cybersecurity is no longer just an information technology issue, but one that requires involvement at the CEO level, said Takanori Nishiyama, the Japan head of Keeper Security Inc.

“The incident triggered a shift in management’s mindset,” said Nishiyama, who sees the cybersecurity as something that’s become “an agenda which CEOs must be actively involved in.”