Asahi Reported Its 2025 Accounts Six Months Late and Declared Its Controls Ineffective. The Security Rules Were Already Written

Asahi Super Dry sold 15% more volume outside its home markets in 2025. In the same year, the company lost the ability to close its own books.

On 27 July 2026, Asahi Group Holdings filed its internal control report for the year ended 31 December 2025 with the Kanto Local Finance Bureau. It stated that its internal control over financial reporting was not effective. That is a formal admission under Japan's Financial Instruments and Exchange Act. It is rare at this size. Asahi carries a market value above 2.5 trillion yen.

What the filing actually says

The cause was the ransomware attack of 29 September 2025. The filing sets out the attack path in unusual detail. The attacker gained administrative privileges without authorisation, used compromised accounts to explore the internal network, then executed ransomware on multiple servers. Asahi disconnected its internal and external networks and isolated the data centre the same day.

Then comes the part worth reading twice. Asahi says the rules were already in place. The Asahi Group Information Security Regulation had, in the company's words, "comprehensively defined requirements for integrated security management". It also set out the technical steps needed to keep attackers out. What failed was operation. Within part of the system estate used for business in Japan, "certain operational management activities, including access rights management required under these rules, had not been sufficiently implemented".

The rulebook was written and approved. Parts of it were never run. The weakness was filed against group-level controls covering how information systems are built and looked after in Japan.

A clean audit sitting next to a failed control

The same filing records that the auditor issued an unqualified opinion on the consolidated financial statements, and that all necessary corrections have been reflected. Both things are true at once.

A material weakness is a judgement on the machinery that produces the numbers, not on the numbers themselves. Asahi could not pull and check its accounting data on time. It ran the close through work-arounds, then asked for more time to file its annual securities report. The figures came out right. The route to them gave way.

What the delay cost

The 2025 results were originally scheduled for 10 February 2026. They were published on 8 July. The securities report followed on 27 July, under an extension granted back in March. On 29 July, Asahi finally set a date for its first quarter of 2026: 14 August, four and a half months after the quarter ended. The second quarter date will be announced on the same day.

Six months to report a year, and four and a half months to report a quarter. For most of that period the market priced Asahi on monthly sales notes. One regional update said plainly that the company could not work out accurate revenue or core operating profit for Japan and East Asia.

The damage shows in the figures Asahi did publish. In January to March 2026, six months after the attack, Asahi Breweries beer-type revenue ran at 84% of the same period a year earlier. Asahi Soft Drinks volume sat at 88%. Asahi Group Foods held at 98%. Europe fell 2.4% and Asia Pacific grew 1.5%, because the trouble stopped at the Japanese systems.

Group revenue for 2025 fell 1.5%, core operating profit fell 7.8%, and profit fell 36.4% to 122.8 billion yen. In the same year unit prices rose 2.9% and Peroni Nastro Azzurro grew 6% outside home markets. The brands held. The plumbing gave way.

Why this sits closer to home than most boards think

Food and drink groups run one shared finance centre and one accounting system per region. That design is efficient, and it puts the risk in one place. Coca-Cola halted United States production at Fairlife in July 2026 after ransomware reached plant systems, and restarted in about ten days. Asahi restarted its plants too, with all shipments resuming by April. Reporting took far longer than the factories.

Most cyber spending in this industry defends the plant and the brand, and the month-end close is rarely on the list.

What happens next

The remediation Asahi describes is unglamorous. Fix access privilege management across every system inside the financial reporting scope. Tighten access controls and passwords. Run monitoring under an Information Security Committee. Run Fit and Gap checks on critical systems to find where the written rule and the daily practice have drifted apart. Access rights are the cheapest control in the building and the one most often left to rot.

Asahi is doing all of this while completing its largest overseas purchase. It expects to close the roughly 3 billion dollar purchase of Diageo's East African business in the second half of 2026. That brings in 100% of Diageo Kenya, 65% of East African Breweries and ten plants across Kenya, Uganda and Tanzania. Guidance for 2026 is revenue up 11.2% and core operating profit up 10.6%. A group still repairing its own control environment is about to absorb ten plants in three new countries.

For buyers, lenders and investors the fix is cheap. Internal control reports are public, short, and they name the exact control that failed. Read the control report before you read the strategy pack. The 14 August print is the first clean look at Japan since the attack, and the first real test of whether recovery moves as fast as the forecast assumes.