KP Snacks supply chain shut down by Conti ransomware attack

KP Snacks, the maker of some of the UK's most popular crisps and nuts, has warned suppliers that a ransomware attack has left it unable to safely process orders or dispatch goods.

The company, which makes popular brands such as Hula Hoops, McCoys, Discos, and KP Nuts, said that an attack in January had crippled its IT and communications systems, according to letters issued to partner stores, as seen by BetterRetailing.

After an initial investigation of an IT outage on Friday 28 January, KP said it was able to confirm this week that its systems had been "compromised by ransomware".

"Through the weekend our IT Team and third party experts have been assessing the scale of the intrusion and continue to do so," KP said in its letter to partners. "As a result, at this stage we cannot safely process orders or dispatch goods."

The Conti ransomware group has taken credit for the attack, according to leaked documents seen by Bleeping Computer, and it appears the outfit has access to credit card statements, employee contact details and other sensitive information.

Conti's involvement is also corroborated by security researchers DarkFeed, which tweeted that the group had given KP Snacks five days in which to negotiate before the data is leaked on their public blog. It isn't clear if KP is negotiating with the hackers, though it has brought in a "legal council".

"As soon as we became aware of the incident, we enacted our cyber security response plan and engaged a leading forensic information technology firm and legal counsel to assist us in our investigation," a spokesperson for KP Snacks said. "Our internal IT teams continue to work with third-party experts to assess the situation."

KP's supply chain has been directly affected by the attack, with delivery and order issues expected to continue through to the end of March "at the earliest", the company said.

Conti ransomware explained

Conti ransomware is a relatively new strain of malware that is peddled by the same organisation that operated the Ryuk ransomware. The group is also known by the moniker 'Wizard Spider', and is thought to be a Russian-linked operation based in Saint Petersburg.

The group has previously been classed as a 'ransomware as a service' (RaaS) operation, where its main members supply the malware to paid affiliates who then use it to breach the infrastructure of a victim for a percentage of the profits.

The firm has had a lot of success since coming into notoriety in 2020; in September, Conti was used to shut down the entire IT system for Ireland's Health Services Executive.