Constangy Cyber Advisor 

Operations for Japan-based beverage giant Asahi Group Holdings recently shut down after a cyberattack, causing a ripple effect that extended far beyond its breweries.

The incident forced Asahi, best known in the United States for its beer, to temporarily suspend shipments and some domestic operations as engineers worked to restore systems. The company has confirmed that, at this time, no customer data seems to have been compromised. However, the attack has affected the company’s information and operational technology networks. 

The interruption at Asahi highlights a growing concern for organizations: the rising vulnerability of  “operational technology.”

Operational attacks can have severe consequences

Ransomware and data breaches are in the news constantly, and they are a serious concern. But less well known are attacks that affect operational environments. Unlike information systems, operational technology systems manage physical processes such as mixing, packaging, and shipping a company’s products. When those systems fail, production stops immediately. 

In Asahi’s case, the threat group Qilin reportedly claimed responsibility, alleging that it stole approximately 27 gigabytes of internal data. That claim may or may not turn out to be true, but the attack demonstrates how quickly a breach can spread from networks to interconnected factory systems. 

Lessons from the Asahi breach

Asahi’s experience carries lessons for every industry that depends on connected physical systems, including energy, health care, and transportation.

• Vulnerabilities across operations can intersect. Once a hacker breaches a corporate network, they may find that the operational systems are only a few steps away.
• Access management is a weak point. Operational technology environments often rely on legacy authentication systems designed for convenience rather than security. Without strict identity verification and limited permissions, attackers can exploit those openings to gain control. 
• Vendor risk is a concern. External technicians frequently maintain or update industrial software remotely. If not tightly secured and monitored, each remote connection can serve as a potential entry point.

Perhaps the most instructive aspect of Asahi’s response was its need to halt production entirely to contain the attack. That decision was appropriate under the circumstances, but it underscores how companies need strategies that can safely shut down and restart operational technology systems without compromising integrity.

In this sense, cybersecurity and business continuity are now inseparable. The most significant cost of an incident may not be the ransom payment or data loss, but the operational downtime and reputational damage that follow.

Moving toward resilience

Companies seeking to protect their operational technology systems can strengthen resilience through a few key actions. These practices not only reduce the likelihood of a successful attack but also improve recovery speed in the event of an incident.

• Segregate IT and OT networks. Create clear boundaries between your IT networks, on the one hand, and your operational technology networks, on the other, using firewalls or gateways to contain attacks.
• Adopt a zero-trust approach. Authenticate every user and device, whether inside or outside the network.
• Enhance monitoring. Use tools that understand industrial protocols and can detect anomalies as they occur.
• Control privileged access. Rotate credentials, apply just-in-time privileges, and log all administrative actions.
• Prepare and test response plans. Include operational technology scenarios in tabletop training exercises, and ensure cross-team coordination.
• Assess vendor security. Require cybersecurity commitments in vendor contracts, and verify compliance regularly.

The Asahi breach shows that businesses must preserve their ability to function in addition to protecting their data. Companies that invest in resilient architectures and cross-functional response planning will be better positioned to weather the next attack, whatever form it takes.

The Constangy Cybersecurity & Data Privacy Team assists businesses of all sizes and industries develop a comprehensive incident response plan or support with a breach. We are here to help! The Constangy Cyber Team is available 24/7. Contact us at breachresponse@constangy.com or by phone at 877-DTA-BRCH.