InstantWhip targeted by Hunters International ransomware group

• Ransomware group: Hunters
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: November 27, 2023

The ransomware group known as Hunters International has listed the American company InstantWhip on its leak site. The threat actor claims to have successfully breached the organization's systems and encrypted its data, marking a significant incident for the food service supplier.

The claims of the threat actor

According to the announcement made on November 27, 2023, the Hunters International group asserts that they have gained unauthorized access to the internal systems of InstantWhip. The group claims to have performed a double extortion attack, a common tactic in modern ransomware operations where attackers not only encrypt the victim's data to disrupt operations but also exfiltrate sensitive information to use as leverage for ransom demands.

In such scenarios, threat actors typically threaten to publish stolen data on public leak sites if the victim refuses to pay. While the specific ransom demand for this incident was not disclosed in the announcement, the group has provided sample files as part of their public claim to demonstrate the validity of the breach. This method is used by various ransomware groups to pressure organizations into compliance by threatening the exposure of proprietary information.

Data exfiltration details

The leak site announcement provides specific details regarding the types of information the group claims to have stolen from the organization. Based on the provided screenshots, the exfiltrated data is categorized into specific sets. The total number of files identified in the leak is 24.

The categories of data claimed to be stolen include:

• Requested files
• Product formulas

The exposure of such specific documentation, particularly product formulas, represents a significant risk to the target organization's intellectual property and operational security.

About InstantWhip

InstantWhip is an American company that specializes in the supply of whipped cream, sauces, and various other dairy products. The firm primarily serves the food service industry, providing essential ingredients for professional kitchens and the retail sector. Having been in operation since the 1930s, the company is a long-standing entity within the food production and distribution market.

Risk assessment and industry implications

The claims made by Hunters International carry heavy implications for InstantWhip. The group is assessed to have emerged in 2023 and is noted for being linked to Hive ransomware code. The potential exfiltration of product formulas is particularly damaging, as it may lead to the exposure of critical trade secrets and a subsequent loss of competitive advantage in the food manufacturing market.

Because the organization is based in the United States, this incident may trigger complex legal processes under various state-level privacy laws and federal regulations. Furthermore, the leak of such sensitive data could create secondary risks for the organization's broader supply chain, including its partners and customers who rely on their products and information security.

In the broader context of the cybersecurity landscape, organizations in the retail and food service sectors can take several defensive steps to mitigate these risks. Implementing robust network segmentation, maintaining rigorous backup protocols, and conducting regular security audits are standard practices for defending against ransomware. Additionally, monitoring for unusual data exfiltration patterns can help identify a breach before the data is published on a leak site. It is also worth noting that some reports suggest the group may have shifted its operational strategies, with some reports indicating they ceased encryption activities as of 2025.