IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

KP Snacks supply chain shut down by Conti ransomware attack

Crippled IT systems are unable to process new orders "safely" and could be down until late-March

A bag of Hula Hoops tipped over with crisps tumbling out of a packet

KP Snacks, the maker of some of the UK's most popular crisps and nuts, has warned suppliers that a ransomware attack has left it unable to safely process orders or dispatch goods.

The company, which makes popular brands such as Hula Hoops, McCoys, Discos, and KP Nuts, said that an attack in January had crippled its IT and communications systems, according to letters issued to partner stores, as seen by BetterRetailing.

Related Resource

Identity-focussed security for your zero trust journey

Steps to protect your business from identity-driven threats

Title of the webinar in white text against a blue backgroundWatch now

After an initial investigation of an IT outage on Friday 28 January, KP said it was able to confirm this week that its systems had been "compromised by ransomware".

"Through the weekend our IT Team and third party experts have been assessing the scale of the intrusion and continue to do so," KP said in its letter to partners. "As a result, at this stage we cannot safely process orders or dispatch goods."

The Conti ransomware group has taken credit for the attack, according to leaked documents seen by Bleeping Computer, and it appears the outfit has access to credit card statements, employee contact details and other sensitive information.

Conti's involvement is also corroborated by security researchers DarkFeed, which tweeted that the group had given KP Snacks five days in which to negotiate before the data is leaked on their public blog. It isn't clear if KP is negotiating with the hackers, though it has brought in a "legal council".

"As soon as we became aware of the incident, we enacted our cyber security response plan and engaged a leading forensic information technology firm and legal counsel to assist us in our investigation," a spokesperson for KP Snacks said. "Our internal IT teams continue to work with third-party experts to assess the situation."

KP's supply chain has been directly affected by the attack, with delivery and order issues expected to continue through to the end of March "at the earliest", the company said.

Conti ransomware explained

Conti ransomware is a relatively new strain of malware that is peddled by the same organisation that operated the Ryuk ransomware. The group is also known by the moniker 'Wizard Spider', and is thought to be a Russian-linked operation based in Saint Petersburg.

The group has previously been classed as a 'ransomware as a service' (RaaS) operation, where its main members supply the malware to paid affiliates who then use it to breach the infrastructure of a victim for a percentage of the profits.

The firm has had a lot of success since coming into notoriety in 2020; in September, Conti was used to shut down the entire IT system for Ireland's Health Services Executive.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022