Asahi forced to take orders by fax as Japan races to avoid beer shortage

Asahi Group Holdings is experiencing significant operational and financial disruption following a ransomware cyberattack that crippled its IT systems, forcing manual order processing and delaying product launches. While production has largely resumed, logistics and customer service for its Japanese operations, which account for half of its sales, remain severely impacted. The incident led to an initial 7% share price decline, with analysts estimating an 83% hit to domestic operating profit if the outage extends through October, prompting concerns among retailers about potential beer shortages and brand switching. This event highlights the increasing vulnerability of Japanese companies to cyber threats, despite Asahi having previously identified cyberattacks as a major business risk.

Analysis

Asahi Group Holdings is experiencing severe operational disruption following a ransomware attack on September 29th, crippling its IT systems and forcing manual order processing via fax and phone for its Japanese operations. This incident has led to an indefinite postponement of 12 new product launches and partial suspension of non-flagship beer, soft drink, and food product shipments. The company's share price initially tumbled over 7% before a modest recovery, reflecting immediate market concern.

The cyberattack primarily affects Asahi's Japanese operations, which account for approximately half of its total sales, while overseas operations remain unaffected. Bernstein analysts estimate an 83% hit to domestic operating profit if the outage extends through October, highlighting significant financial exposure. Retailers like Seven & I Holdings and Monogatari Corp are already reporting potential shortages of Asahi Super Dry and considering switching to rival brands, indicating a risk of market share erosion.

Despite Asahi having identified cyberattacks as a major risk in a prior assessment, the prolonged recovery suggests inadequate preparation, as noted by security experts. This incident underscores a broader trend of increasing ransomware attacks on Japanese companies, with 116 reported in H1 2025, matching a 2022 high, due to perceived poor defenses. The company has confirmed potential unauthorized data transfer but maintains no customer data was compromised.

Key Decisions for Investors

• Monitor Asahi's recovery timeline and the potential for sustained market share erosion in its domestic Japanese operations due to retailer switching.
• Evaluate the financial impact of the estimated 83% domestic operating profit hit if system restoration is prolonged, and assess the company's long-term cybersecurity investment strategy.
• Consider the broader implications for Japanese companies with significant domestic operations, as this incident highlights systemic cybersecurity vulnerabilities in the region.