Asahi Cyber Attack Highlights Rising OT Security Risks in Manufacturing

What's Happening?

Asahi Group Holdings has experienced a cyber attack affecting its operations in Japan, leading to the suspension of order and shipment operations, as well as call center services. The attack underscores the vulnerability of manufacturing systems to cyber threats, particularly those reliant on operational technology (OT). While no personal or customer data leakage has been confirmed, the disruption has significant commercial implications. The incident is part of a broader trend of cyber attacks targeting infrastructure essential for business continuity, rather than just data theft. Manufacturing in the Asia-Pacific region is increasingly targeted, with the sector accounting for 40% of cyber attacks in the region.

Why It's Important?

The cyber attack on Asahi highlights the critical need for robust cybersecurity measures in the manufacturing sector, particularly for OT systems. As manufacturing processes become more interconnected, vulnerabilities in outdated systems and third-party tools can lead to significant disruptions. The attack serves as a warning for manufacturers globally to prioritize operational continuity alongside data protection. The rising cost and difficulty of securing cyber insurance for manufacturers further emphasize the importance of strengthening cybersecurity controls. This incident may prompt governments to enforce stricter cybersecurity regulations within critical infrastructure.

What's Next?

Asahi is actively investigating the cause of the cyber attack and working to restore operations, though no timeline for recovery has been provided. The incident may lead to increased scrutiny of cybersecurity practices within the manufacturing sector, potentially resulting in mandatory audits and stronger supplier controls. Manufacturers may need to invest in updating and securing their OT systems to prevent future disruptions. The attack could also influence the cyber insurance market, making it more challenging for manufacturers to obtain coverage without demonstrating robust cybersecurity measures.