KP Snacks supply chain shut down by Conti ransomware attack
Crippled IT systems are unable to process new orders "safely" and could be down until late-March
KP Snacks, the maker of some of the UK's most popular crisps and nuts, has warned suppliers that a ransomware attack has left it unable to safely process orders or dispatch goods.
The company, which makes popular brands such as Hula Hoops, McCoys, Discos, and KP Nuts, said that an attack in January had crippled its IT and communications systems, according to letters issued to partner stores, as seen by BetterRetailing.
RELATED RESOURCE
Identity-focussed security for your zero trust journey
Steps to protect your business from identity-driven threats
After an initial investigation of an IT outage on Friday 28 January, KP said it was able to confirm this week that its systems had been "compromised by ransomware".
"Through the weekend our IT Team and third party experts have been assessing the scale of the intrusion and continue to do so," KP said in its letter to partners. "As a result, at this stage we cannot safely process orders or dispatch goods."
The Conti ransomware group has taken credit for the attack, according to leaked documents seen by Bleeping Computer, and it appears the outfit has access to credit card statements, employee contact details and other sensitive information.
Conti's involvement is also corroborated by security researchers DarkFeed, which tweeted that the group had given KP Snacks five days in which to negotiate before the data is leaked on their public blog. It isn't clear if KP is negotiating with the hackers, though it has brought in a "legal council".
"As soon as we became aware of the incident, we enacted our cyber security response plan and engaged a leading forensic information technology firm and legal counsel to assist us in our investigation," a spokesperson for KP Snacks said. "Our internal IT teams continue to work with third-party experts to assess the situation."
KP's supply chain has been directly affected by the attack, with delivery and order issues expected to continue through to the end of March "at the earliest", the company said.
Conti ransomware explained
Conti ransomware is a relatively new strain of malware that is peddled by the same organisation that operated the Ryuk ransomware. The group is also known by the moniker 'Wizard Spider', and is thought to be a Russian-linked operation based in Saint Petersburg.
The group has previously been classed as a 'ransomware as a service' (RaaS) operation, where its main members supply the malware to paid affiliates who then use it to breach the infrastructure of a victim for a percentage of the profits.
The firm has had a lot of success since coming into notoriety in 2020; in September, Conti was used to shut down the entire IT system for Ireland's Health Services Executive.
-
Cato Networks opens new London hub in regional R&D driveNews The new R&D site aims to capitalize on the UK’s tech ecosystem to drive AI and security innovation
-
Ransomware group profits are rising faster than FTSE 350 firmsNews Sophisticated infrastructure allows servers, leak sites, and negotiation portals to be quickly rebuilt after disruption
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacks
News Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
