Please enter a keyword

Lion Cyber incident update 26 June 2020

Below is a further update on the cyber-attack and IT system outage that Lion is experiencing.

26 June 2020:
Over the past week, Lion has continued to make progress in restoring many of our key systems following the cyber attack that caused a partial IT outage.   

In terms of our operations, we have managed to get all our breweries back up and running. We are now brewing, kegging, packaging and distributing beer at our nine major breweries across Australia and New Zealand.  

All our dairy and juice sites are operational as well; and across many parts of our business customers are once again able to place orders and view their invoices online. We are working hard to get all of our customer ordering platforms operational as soon as possible and we thank our customers for their patience during this very challenging period.  

Despite this progress, we do still expect to see some further disruptions as we continue to restore systems. We will continue to work with our team of experts to complete this work as quickly as possible, minimising any further disruptions, including to supply.

The timing of this attack – just as the hospitality industry is trying to get back on its feet post COVID-19 closures – could not have been more challenging for Lion and our industry partners. 

As we progress our recovery efforts, it is our number one priority to get back to our usual high standards of service levels before this cyber attack, and support our many valued business partners in what we hope will be a better second half of 2020.  

To date, we still do not have evidence of any data being removed. As we indicated last week, it remains a real possibility that data held on our systems may be disclosed in the future.  Unfortunately, this is consistent with these types of ransomware attacks.   

Our expert teams are continuing to do all they can to investigate this further and as previously stated, if we do identify any cases of data being taken or misused, Lion will contact the affected individuals directly.  

Our dedicated cyber help line remains open 24 hours, 7 days a week, and we encourage any Lion stakeholders that may have questions or concerns about the cyber attack to use this service.  

Australia: 1800 316 512    

New Zealand: 0800 623 367    

International: +61 3 8597 7266    

Once again, we would like to thank our people, customers, suppliers, and stakeholders right across the business for their ongoing patience, understanding and support over the last few weeks as we have done our best to navigate this period. 


19 June 2020:
As the Australian Prime Minister stated this morning, there is a range of sophisticated cyber attacks on Australian businesses, governments, associations and political parties. 

We support the Prime Minister’s comments in relation to cyber safety and reiterate the Australian Government’s advice to visit www.cyber.gov.au

To provide additional support to our stakeholders, we’ve also established a dedicated cyber help line: 

New Zealand: 0800 623 367  

Australia: 1800 316 512 

International: +61 3 8597 7266 

Lion and our expert cyber team continue to investigate the ransomware attack that caused a partial IT outage last week.  

It’s important to reinforce that while this attack has had an impact on our operations, we are still brewing beer and manufacturing our dairy and drinks brands, and we’ve managed to keep shipping products to many of our customers.  While our service is still not at our expected levels, we are doing our very best to resume normal operations. 

Despite experiencing some setbacks over the last 24 hours, which is consistent with this kind of cyber-attack, our team of local and international experts are working hard to safely restore our systems and further improve our defences.  

There have been reports of Lion document lists posted online in recent days. Given this development, our expert teams are doing all they can to investigate whether any data has been removed from our system. Unfortunately, based on the experience of others in this situation, it is possible this may have occurred. 

We’ve made contact with stakeholders as a precaution, as we believe this is the right thing to do. 

In the future, if we have concerns about or if we identify any data misuse we will be in touch with the affected individuals directly. 

We remind everyone to be vigilant about cyber safety, particularly in terms of telephone, SMS, email and social media phishing scams requesting personal information or payment of money.  Never open attachments from unknown senders, and always check that any email is legitimate before responding. 

The best tips remain: 

  • change your online account passwords regularly. Use a password manager for remembering multiple passwords.  
  • never email yourself passwords for online accounts.  
  • enable multi-factor authentication for your online accounts where possible and ensure you have up-to-date anti-virus software installed on any device used to access online accounts.  

More information about phishing scams and general cyber safety can be found here:   




New Zealand   


We have notified the authorities of the incident; and will work alongside the relevant government authorities, law enforcement agencies and privacy regulators, as required.  

We are so grateful for all the support we have received over the last week and the flexibility and understanding of our customers, suppliers and our people. 

We will continue to provide regular updates on this webpage https://www.lionco.com/media-centre/lion-update-re-cyber-issue   


15 June 2020:
Our investigations have shown that a partial IT system outage at Lion is a result of a ransomware attack. In response, we immediately shut down key systems as a precaution. 

Our IT teams and expert cyber advisors have continued working throughout the weekend to investigate this incident, working to bring systems back online safely.  

We have made good progress, however there is still some way to go before we can resume our normal manufacturing operations and customer service.  

Current impact on Lion’s operations  

Across our Australian and New Zealand adult beverages businesses, we continue to have limited visibility of our products in our systems. We’re working to bring our breweries back online as soon as possible, hoping to get a number of our breweries back up and running very soon. 

We apologise to our consumers and customers, especially those who are only just getting their own venues back up and running following COVID-19 closures. We thank them for their patience as we do everything we can to get back to normal supply levels. 

Lion Australia  

The latest impacts include a number of temporary shortages or out-of-stocks across both packaged (bottle/can) and keg brands.  

While our systems are offline, we have worked very hard to be able to supply a limited number of key products to our customers.  We will continue to accept and fulfil orders as best we can, using interim manual processes where we need to. 

Lion New Zealand  

Whilst our systems are impacted, we are working hard to be able to supply key products to our customers. We have sufficient supply of the majority of our pack beer brands but we are experiencing temporary shortages of some of our brands of keg beer. Our Customer Call Centre and ordering systems are now operational. Speight’s Brewery has begun to commence production again today.

Lion Dairy & Drinks 

In the Dairy & Drinks Business, we continue to experience some interruptions at sites across our manufacturing network and some parts of our customer service systems remain offline. Unfortunately, due to the nature of fresh dairy and juice products we have experienced some service misses across our customers. We are continuing to do all we can to service customer demand, including having our people work with customers to assist with manual ordering and delivery and moving to manufacture different products at our various dairy sites across the network.  

We appreciate the ongoing support and patience of our customers, network partners, suppliers and consumers. There has been no impact to the collection of milk from our dairy farmers partners across Australia or fruit from our growers.  

Update on our recovery efforts  

The restoration process is taking time but it’s important that we do this methodically and safely as we work to resume normal business operations.  

There remains no evidence that any of the information contained in our system (including financial or personal information) has been affected. This is something that we will continue to review closely as part of our ongoing investigations. 

We have notified the authorities of the incident; and we will work alongside the relevant government authorities, law enforcement agencies and privacy regulators, as required. 

We would also like to take this opportunity to remind everyone to be vigilant about cyber safety, particularly in terms of telephone, SMS, email and social media phishing scams requesting personal information or payment of money. It’s advisable to avoid opening attachments from unknown senders and ensure that any communications are legitimate before responding.  

More information about phishing scams and general cyber safety can be found here:  




New Zealand  


Next steps 

We will continue to provide regular updates on this webpage https://www.lionco.com/media-centre/lion-update-re-cyber-issue  


12 June 2020:
Below is a further update on the cyber-attack and IT system outage that Lion is experiencing. 

Our investigations to date have shown that a system outage has been caused by ransomware. The ransomware targeted our computer systems. In response, we immediately shut down key systems as a precaution. 

Our IT teams and expert cyber advisors are working around the clock, investigating the issue and assessing how long the impacts will continue. Our focus is on bringing systems back online safely so we can resume our business as usual manufacturing, and customer services. This is taking some time, but it is necessary that we work through this properly. 

Current impact on Lion’s operations  

Our teams are working as hard as they can to service customers and suppliers, implementing new manual processes and investigating all alternative options. We recognise this is imperfect and is causing disruption to our valued partners. We also recognise this is happening at an unfortunate time as we emerge from COVID-19 restrictions. 

Lion Australia and New Zealand 

Throughout the COVID-19 shutdown, we were able to continue to brew beer safely. We had stock at hand and were gearing up to increase brewing. This attack has delayed those plans, and because of the situation we have limited visibility of our products. We’re working to bring our breweries back online as soon as possible. In the meantime, we will be managing our stock levels very closely and may see some temporary shortages. 

We apologise in advance to our customers and consumers and ask for their patience as we do what we can to get back to normal supply levels. 

Lion Dairy & Drinks  

In the Dairy & Drinks business, some parts of customer service continue to be impacted and some of our manufacturing sites remain offline. Unfortunately, due to the nature of fresh dairy and juice products we are experiencing some service misses across our customer channels. We are continuing to do all we can to ensure we can service the demand of our customers and have a team of people working with customers to assist with manual ordering and delivery. We appreciate the patience and support of our customers, network partners, suppliers and consumers. There has been no impact to the collection of milk from our dairy farmer partners or fruit from our orange growers. 

Update on our recovery efforts  

We had been hoping to have full access restored by now, but unfortunately this process is taking longer than we hoped.  

There is no evidence that any of the information contained in our system (including financial or personal information) has been affected but this is something that we will review closely as we continue to investigate the incident. 

We have notified the authorities of the incident; and we will work alongside the relevant government authorities, law enforcement agencies and privacy regulators, as required.  

Next steps 

We are working hard to resolve this incident as quickly as we can so we can return to full production and get our products flowing back into the market.  

We will continue to provide regular updates on this webpage. 



10 June 2020:
On Monday Lion was a victim of a cyber-attack. We immediately shut down all our systems as a precaution, and we have continued to work with cyber experts to determine how much longer our systems will be impacted. That said, we have made substantial progress over the last 24 hours in terms of diagnosis and recovery planning.  

We are working through the impacts. There is no evidence to date of any data breaches, but we are still investigating every aspect of this major incident.

To support our customers and suppliers, we have already introduced a number of manual systems to allow us to take orders and then ship products around our networks. 

We recognise that this is not perfect and it is impacting our customers. We are doing everything possible under the circumstances. 

We have teams working around the clock to bring our systems back online safely. Again, we apologise for the inconvenience this has caused our suppliers, customers and our broader supply chain. We appreciate your patience and support during this challenging time.  

We are thankful to our team for responding so quickly, using the latest advanced tools to return systems safely as soon as possible.  

Lion Australia and New Zealand

This attack could not have come at a worse time for Lion, particularly for our valued pub and club customers who are in the very early stages of recovery following the COVID-19 closures. They are in the early stages of rebuilding, restocking and reengaging their staff and in New Zealand are able to operate with no restrictions for the first time in months following the move to COVID-19 Alert Level 1 this week. This has been the most devastating time on record for the hospitality industry.   

Throughout the COVID shutdown, we were able to continue to brew beer safely, meaning we have a good supply of product for the time being. In saying that, this attack has impacted crucial aspects of the brewing process. We operate multiple large-scale breweries, which are heavily reliant on IT infrastructure.     

Lion Dairy & Drinks

In the Dairy & Drinks business, some parts of customer service still remains offline and whilst we are operating across most of our manufacturing network, due to the nature of fresh dairy and juice products there have been some service misses in some customer channels as we have worked to manually key and pick orders. We are continuing to do all we can to ensure we can service the demand of our customers and have a team of people working with customers to assist with ordering and delivery. We thank our customers, network partners, suppliers and consumers for their patience at this time. There has been no impact to the collection of milk supply from our dairy farmer partners or fruit from our orange growers. 


9 June 2020:
Lion has experienced a cyber incident and has taken the precaution of shutting down our IT systems, causing some disruption to our suppliers and customers.  

We’re working with expert advisors to address the issue. We have alerted the authorities and are working hard to minimise disruption to customers and suppliers.  

We will provide further updates when we can, and we thank our customers and suppliers for their patience.