K.M. Packaging Co., Ltd listed on Direwolf ransomware leak site

• Ransomware group: Direwolf
• Country: Thailand
• Sector: Manufacturing
• Announcement date: June 10, 2025

Direwolf claims data breach at K.M. Packaging Co., Ltd

The threat actor known as Direwolf has listed K.M. Packaging Co., Ltd on their leak site, claiming to have stolen a significant amount of data from the organization. According to the announcement made on June 10, 2025, the group alleges to have obtained an 82 GB dataset belonging to the company.

The incident was announced on the group's leak site on June 10, 2025, which matches the date the group claims the attack occurred. As part of their extortion process, the group has already published a file list and sample files to demonstrate the validity of the stolen information. However, the full document set is not scheduled for release immediately; the threat actor has indicated that the complete collection of documents is slated for publication on June 30, 2025.

Details of the claimed stolen data

The data allegedly exfiltrated by Direwolf is described as containing both financial and operational information essential to the company's functions. The group claims that the stolen dataset includes a wide variety of sensitive documents that could impact the organization's internal processes and external relationships. The specific types of data mentioned in the leak site post include:

• Financial documents
• Customer information
• Insurance contracts
• Business contracts
• Accounting records
• Audit files

The inclusion of such diverse documentation suggests a broad compromise of the organization's digital environment, touching upon various departments from finance and accounting to legal and customer relations.

About K.M. Packaging Co., Ltd

K.M. Packaging Co., Ltd is a Thailand-based company specializing in the production of packaging solutions for the food and beverage industry. As a provider in the manufacturing sector, the company plays a role in the supply chain for food and drink products, making its operational and business data highly sensitive to its partners and clients.

Risk assessment and implications

This incident may pose a significant risk of exposing sensitive data held by K.M. Packaging Co., Ltd. The potential leakage of customer and employee information could lead to various secondary risks, such as identity theft or targeted phishing attacks against the affected individuals. Furthermore, the publication of operational and financial data may result in damage to the company's competitive advantage and corporate reputation.

The organization may also face legal sanctions under Thai data protection regulations due to the nature of the exposed information. While public information regarding the Direwolf group remains limited, the use of double extortion tactics—whereby attackers both encrypt data and threaten to leak it—indicates that the company may face ongoing secondary risks. In such scenarios, organizations often face pressure to pay a ransom to prevent the public release of sensitive information.

For organizations in the manufacturing and food supply chain sectors, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps include implementing strict access controls, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.