KohaFoods Hawaii listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: November 12, 2025

Inc Ransom claims data breach at KohaFoods Hawaii

The threat actor known as Inc Ransom has listed KohaFoods Hawaii on its dedicated leak site. In an announcement published on November 12, 2025, the group claimed to have successfully compromised the organization and exfiltrated a significant amount of data. This disclosure follows the group's established pattern of using leak sites to announce successful intrusions and pressure victims through the threat of data exposure.

The incident was announced on the same day the group claims the attack took place. According to the information provided by the threat actor, the group has gained access to the organization's operational data. This type of announcement is a hallmark of modern ransomware operations, where the threat actor uses the threat of publicizing stolen information to increase the pressure on the victim to fulfill their demands.

Details of the alleged exfiltration

While the group has publicly announced the breach, specific details regarding the exact nature of the alleged leaked data have not been provided. The announcement does not specify the types of files or the specific categories of information that were targeted during the intrusion. The only concrete detail provided regarding the stolen information is the total volume of the data involved.

• Claimed data size: 133 GB

The listing does not specify the number of files involved or the specific ransom demand requested by the group. The disclosure appears to be a part of the group's double extortion strategy, a tactic where attackers not only encrypt a victim's systems but also steal sensitive data to threaten its public release or sale on the dark web.

About KohaFoods Hawaii

KohaFoods Hawaii is a distributor and wholesaler based in Hawaii, specializing in the distribution of Asian food products. The company has been operating since 1970 and maintains a significant presence in the regional food supply chain. Their extensive inventory includes over 2,500 items, ranging from seafood to various Korean dishes, serving a diverse client base that includes local businesses and supermarkets.

Potential risks and industry implications

The exfiltration of organizational data can lead to various secondary risks. One primary concern is the potential exposure of sensitive information belonging to employees and customers. When such data is compromised, it can lead to identity theft, phishing campaigns, and other forms of fraud targeting the individuals whose information was contained within the stolen datasets.

Because KohaFoods Hawaii is based in the United States, any potential data breaches may be subject to various state-level privacy laws and regulations. These legal frameworks often dictate how organizations must respond to breaches and the responsibilities they hold toward protecting consumer data. Failure to comply with these regulations can lead to significant legal and financial consequences for an organization.

The use of the double extortion method by Inc Ransom is designed to exert maximum pressure on an organization. By threatening to publish or sell exfiltrated data, attackers aim to impact an organization's commercial reputation and disrupt its operational continuity. For companies in the agriculture and food production sector, maintaining a reputation for reliability and security is vital for maintaining trust with business partners and consumers alike.

To defend against such threats, organizations typically implement layered security strategies. This includes robust backup solutions to ensure operational continuity, strict access controls to limit the movement of attackers within a network, and continuous monitoring to detect unauthorized data transfers. Furthermore, maintaining up-to-date knowledge of threat actor tactics, such as the double extortion methods used by groups like Inc Ransom, is a critical component of a modern cybersecurity posture.