ALPHV ransomware group lists Herrs (You have 72 hours) on its leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: January 23, 2024

The ALPHV ransomware group has published a leak announcement claiming to have compromised data belonging to the US-based food manufacturer Herrs. This development marks a significant escalation in the group's targeting of the food and agriculture sector.

The details of the claim

The ALPHV (also known as BlackCat) group listed Herrs on its dedicated leak site on January 23, 2024. According to the group's announcement, they have successfully executed an attack and are now exerting pressure on the organization. The group has issued a deadline, stating that it will publish the stolen data if the organization does not contact them within 72 hours.

While the group has made this public threat, they have not mentioned a specific ransom amount in their announcement. This tactic is frequently observed in modern cyberattacks, where the threat of data exposure is used as a primary tool for coercion. The group's announcement included contact information for company employees, signaling a shift toward targeting individuals within the organization to increase pressure.

Data involved in the claim

The information provided by the threat actor is currently limited in scope. Based on the available evidence from the leak site, the following data has been identified as being affected:

• Employee contact information

The screenshot provided by the group displays the names and phone numbers of senior human resources and information technology executives of the organization. However, there is no detailed information regarding the full scope or the specific type of the compromised data beyond these individual details.

About Herrs

Herr Foods Inc. is an American manufacturer of potato chips and snack foods. The company markets its products primarily throughout the Eastern United States and distributes them in over 40 countries worldwide.

Analysis and implications

This action by the ALPHV group may create a risk of exposing the personal data of the organization's employees. The leakage of such data could lead to targeted phishing attacks or identity theft attempts against the staff. Because the names and phone numbers of senior executives in human resources and information technology were specifically highlighted, these individuals may be at a higher risk of being targeted by social engineering tactics.

As the organization is based in the United States, it may be subject to state-level data protection laws and notification requirements. Such regulations often mandate that companies inform both regulators and affected individuals when personal data has been compromised.

Given the group's past methods, it may be assessed that they are attempting to exert pressure on the organization through a double-extortion strategy. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with its public release. This method increases the likelihood of a ransom payment by creating reputational and legal risks for the target.

ALPHV is a ransomware group written in Rust that emerged in late 2021, and public information about the group is limited. Organizations in the food and agriculture sector, which often rely on complex supply chains and high-volume distribution, must remain vigilant against such sophisticated threats. General defensive steps for organizations facing these risks include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to help employees recognize phishing attempts.