Liberty Gold Fruit targeted by sinobi ransomware group

• Ransomware group: sinobi
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: November 24, 2025

Sinobi group claims data breach at Liberty Gold Fruit

The threat actor known as sinobi has published an announcement on a leak site claiming to have leaked data belonging to Liberty Gold Fruit. According to the post, the group alleges that a significant amount of sensitive information has been compromised during the attack.

The incident involves a claim of data exfiltration and system encryption. Ransomware attacks typically involve a threat actor gaining unauthorized access to a network, encrypting critical files to disrupt operations, and stealing sensitive data to use as leverage for extortion. This specific method, often referred to as double extortion, involves threatening to publish the stolen information on a public leak site if the ransom demands are not met. This tactic is designed to maximize pressure on the victim by threatening their reputation and legal standing.

Details of the alleged attack and ransom demand

The sinobi group published a leak announcement targeting Liberty Gold Fruit on November 23, 2025. The threat actor claims to have successfully encrypted the organization's systems and is demanding a ransom of 5 million dollars. The announcement specifies that the allegedly compromised data amounts to 40 GB in size.

The group's post indicates that the stolen information is categorized under specific labels. Based on the information provided in the leak announcement, the following data types are allegedly involved:

• Financial data
• Incidents

The presence of such data in a breach can lead to various secondary risks. For instance, when financial records are compromised, it can lead to identity theft or targeted phishing attacks directed at employees and customers. Furthermore, the disclosure of internal incident reports could expose sensitive operational details.

About Liberty Gold Fruit

Operating since 1932, Liberty Gold Fruit Company is a family-owned business that exports premium food products to 40 countries under the LIGO brand. The company maintains a strong distribution network, particularly in Asian, Central American, and European markets, and remains one of the few privately-owned firms in the industry.

Risk assessment and implications

This incident may present a risk of exposure for financial data held by Liberty Gold Fruit. Given the company's location in the US, legal processes under state-level data breach notification laws and relevant regulations may be triggered. The potential for legal and regulatory scrutiny is a common consequence for organizations facing significant data breaches in the United States.

Information about the sinobi group is limited; however, the ransom demand and the threat of data leakage may negatively impact the organization's operational continuity and commercial reputation. The double extortion method could also pose risks to the organization's supply chain partners if the data is published. In the agriculture and food production sector, maintaining the integrity of the supply chain is vital, and a breach of this nature can create ripple effects for partners and distributors.

To defend against such threats, organizations generally focus on implementing robust security frameworks. Common defensive steps include maintaining regular, offline backups of critical data, implementing multi-factor authentication across all systems, and conducting regular security awareness training for employees to prevent initial access through phishing. Additionally, network segmentation can help contain the spread of ransomware once a perimeter has been breached. Monitoring for unusual data exfiltration patterns is also a key component of a proactive defense strategy.