KP Snacks supply chain shut down by Conti ransomware attack
Crippled IT systems are unable to process new orders "safely" and could be down until late-March
KP Snacks, the maker of some of the UK's most popular crisps and nuts, has warned suppliers that a ransomware attack has left it unable to safely process orders or dispatch goods.
The company, which makes popular brands such as Hula Hoops, McCoys, Discos, and KP Nuts, said that an attack in January had crippled its IT and communications systems, according to letters issued to partner stores, as seen by BetterRetailing.
RELATED RESOURCE
Identity-focussed security for your zero trust journey
Steps to protect your business from identity-driven threats
After an initial investigation of an IT outage on Friday 28 January, KP said it was able to confirm this week that its systems had been "compromised by ransomware".
"Through the weekend our IT Team and third party experts have been assessing the scale of the intrusion and continue to do so," KP said in its letter to partners. "As a result, at this stage we cannot safely process orders or dispatch goods."
The Conti ransomware group has taken credit for the attack, according to leaked documents seen by Bleeping Computer, and it appears the outfit has access to credit card statements, employee contact details and other sensitive information.
Conti's involvement is also corroborated by security researchers DarkFeed, which tweeted that the group had given KP Snacks five days in which to negotiate before the data is leaked on their public blog. It isn't clear if KP is negotiating with the hackers, though it has brought in a "legal council".
"As soon as we became aware of the incident, we enacted our cyber security response plan and engaged a leading forensic information technology firm and legal counsel to assist us in our investigation," a spokesperson for KP Snacks said. "Our internal IT teams continue to work with third-party experts to assess the situation."
KP's supply chain has been directly affected by the attack, with delivery and order issues expected to continue through to the end of March "at the earliest", the company said.
Conti ransomware explained
Conti ransomware is a relatively new strain of malware that is peddled by the same organisation that operated the Ryuk ransomware. The group is also known by the moniker 'Wizard Spider', and is thought to be a Russian-linked operation based in Saint Petersburg.
The group has previously been classed as a 'ransomware as a service' (RaaS) operation, where its main members supply the malware to paid affiliates who then use it to breach the infrastructure of a victim for a percentage of the profits.
The firm has had a lot of success since coming into notoriety in 2020; in September, Conti was used to shut down the entire IT system for Ireland's Health Services Executive.
-
Barracuda expands partner program with new enablement toolsNews The cybersecurity vendor has launched new training, demand generation, and partner engagement resources to fuel channel partner growth
-
Microsoft and Databricks target AI business context gains in partnership expansionNews Deeper integration of Databricks Genie within Azure aims to build more context-aware AI
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
