Russia-based crime gang reported behind KP Snacks cyber attack

Russia-based Conti cybercrime gang is responsible for KP Snacks ransomware attack, claimed recent reports, stating that the cybercrime gang has added KP Snacks' logo and company information on its data leak site.

KP Snacks confirmed last week that it has become a target of cyber attack.

“On Friday, 28 January we became aware that we were unfortunately victims of a ransomware incident,” KP Snacks spokesperson told Asian Trader.

“As soon as we became aware of the incident, we enacted our cybersecurity response plan and engaged a leading forensic information technology firm and legal counsel to assist us in our investigation. Our internal IT teams continue to work with third-party experts to assess the situation.

“While this is causing some disruption to our manufacturing and shipping processes, we are already working on plans to keep our products stocked and on shelves.

“We have been continuing to keep our employees, customers, and suppliers informed of any developments and apologise for any disruption this may have caused.”

KP Snacks has reportedly warned stores to expect supply issues. Some retailers have already limited purchases of particular products supplied by KP Snacks, including chips and nuts.

Although the maker is yet to inform further on the matter, multiple reports claim that Conti, a sophisticated Russian-speaking cybercrime group known for its advanced tactics, is behind this attack. The group has already released several sensitive documents stolen in the attack.

Ransomware-as-a-Service (RaaS) operation Conti has ties to the Russian cybercrime group Wizard Spider, which is responsible for the Ryuk, TrickBot, and Bazar Loader malware, stated reports. Conti is known to have successfully hacked multiple state and private enterprises, including Indonesia’s central bank, Ireland’s Department of Health, and the Nordic Choice hotel group.

The attackers reportedly breached the KP Snacks’ internal network, accessing and encrypting financial documents and employee records. According to deep web intelligence reports, KP Snacks have five days to pay the ransom or see further stolen data released.