Performance Food Centers listed on play ransomware leak site

• Ransomware group: play
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: September 29, 2024

Performance Food Centers targeted by play ransomware group

Performance Food Centers has been listed on the leak site of the play ransomware group. The group claims to have compromised data belonging to the organization and has published a leak announcement regarding the incident. This development follows a pattern of activity observed with this specific threat actor, which has been known to operate since 2022.

Details of the claimed attack

According to the announcement made on September 29, 2024, the play ransomware group claims to have successfully exfiltrated private and confidential data from Performance Food Centers. The group has threatened to publish the stolen information if their demands are not met. While the group has made this public claim, the specific details regarding the total volume of data or the specific ransom amount requested have not been provided in the announcement.

The group is recognized for employing double-extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak confidential files on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of sensitive data to the public, competitors, or regulators.

Claimed sensitive data involved

The announcement made by the play group claims that a wide variety of sensitive documents and records have been compromised. The information allegedly stolen includes a range of administrative, financial, and personal files, specifically:

• Client documents
• Budget data
• Payroll data
• Accounting records
• Contracts
• Tax information
• Identification documents

About Performance Food Centers

Performance Food Centers is an organization that provides personalized nutrition plans, supplements, and performance-oriented food solutions for athletes and individuals. The company offers science-based nutritional consulting to help clients achieve their health and athletic performance goals.

Risk assessment and implications

This incident indicates that the organization may be facing the risk of exposure of its financial and operational data. The presence of sensitive information in the claim suggests a significant potential impact on the company's internal functions. Furthermore, the inclusion of personal information in the leaked data could potentially lead to identity theft or targeted phishing attacks against employees and customers.

Because the organization operates in the United States, it may be subject to data breach notification requirements under relevant state laws and federal regulations. Such regulations often dictate how and when an organization must notify affected individuals and government authorities when personal information is compromised.

For organizations operating in sectors involving sensitive client information, such incidents highlight the necessity of robust incident response procedures. To mitigate secondary risks, such as identity theft or further targeted attacks, organizations typically need to initiate response protocols promptly and notify affected parties. Common defensive measures in the face of such threats include strengthening network monitoring, implementing strict access controls, and ensuring comprehensive data encryption to protect information from unauthorized exfiltration.