Loading story…
The Play ransomware gang has claimed responsibility for an attack on Garner Foods, the North Carolina company known for producing Texas Pete hot sauce. Reports say the group listed Garner Foods on its leak site, publicly asserting that it had breached the company and stolen data, a common pressure tactic used to force ransom negotiations.
The incident links a major consumer food brand to a financially motivated extortion operation that has repeatedly targeted organizations across sectors. Public reporting did not confirm the full scope of operational disruption or the exact volume of data allegedly taken, but the claim indicates Garner Foods joined the growing list of victims named by Play as the group continues to use data-theft and public exposure to amplify ransomware attacks.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
The Play ransomware group added Garner Foods, maker of Texas Pete hot sauce, to its leak site and claimed to have stolen company data. Multiple reports in early January 2026 described the same extortion claim, with no earlier incident date provided in the references.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Panzer** ransomware operation has been linked to a reported attack on **The Minor Food Group**, a Thailand-based food and beverage company with thousands of outlets across the Asia-Pacific region. Reporting says the incident was identified on Aug. 10 and framed as a data breach affecting an organization in the **agriculture and food production** sector, marking one of the first publicly noted victim claims associated with the group. Separate threat intelligence reporting describes Panzer as an emerging **ransomware-as-a-service (RaaS)** operation recruiting affiliates on a Russian-speaking cybercrime forum. The group reportedly advertises an **80/20 revenue split**, automated affiliate management, negotiation portals, and leak-site support, and claims ransomware builds for **Windows, Linux, ESXi, and FreeBSD**. Researchers said no public malware sample was available and some capabilities remain unverified, but the Minor Food Group incident suggests Panzer may be moving from recruitment and promotion into active victim operations.
Aug 13, 2026
**Ransomware and data-extortion activity** was reported across multiple sectors, with threat actors using leak sites to pressure victims and amplify impact. The **RansomHub** ransomware-as-a-service operation claimed it breached Chinese manufacturer **Luxshare** and stole sensitive manufacturing and R&D archives allegedly tied to major technology firms (including Apple, Nvidia, Tesla, and LG). The posted sample was described as containing engineering artifacts such as **3D CAD/Parasolid files, PCB manufacturing data, and engineering documentation**, plus some project-related PII; the breach had not been independently confirmed at the time of reporting. Separately, the **Everest** ransomware group claimed it breached **McDonald’s India**, alleging exfiltration of **861 GB** of internal documents and customer personal data and threatening publication if demands were not met; McDonald’s India had not confirmed the claim. In US healthcare, **Valley Eye Associates** confirmed a ransomware incident with **data exfiltration** during a short intrusion window, while **Qilin** publicly claimed responsibility and alleged **139 GB** stolen and posted—suggesting a non-payment outcome. A related but distinct development involved healthcare IT vendor **Veradigm**, which agreed to a **$10.5M** settlement tied to a prior (2024) breach affecting **2+ million** patients, underscoring ongoing legal and financial exposure following large-scale patient-data compromises.
Jun 29, 2026
Dairy Farmers of America, a major Kansas-based farmer-owned dairy cooperative, suffered a significant ransomware attack in June, which was later claimed by the Play ransomware group. The attack resulted in unauthorized access to the cooperative's systems, leading to the theft of sensitive personal information belonging to 4,546 individuals. The compromised data included names, dates of birth, Social Security numbers, bank account details, driver's license or state-issued ID numbers, and Medicare or Medicaid numbers. The breach affected both employees and members of the cooperative, which is responsible for marketing and selling milk and related products from its 9,500 farmer-owners and employs approximately 19,000 people. The organization reported $24.5 billion in revenue in 2022 and is responsible for producing about 23% of all U.S. milk, highlighting the potential impact of the attack on the broader food and agriculture sector. The attackers gained access to the network through a sophisticated social engineering campaign, which enabled them to bypass security controls and begin exfiltrating data shortly after the initial compromise. Dairy Farmers of America discovered the breach two days after the attack began and subsequently launched an internal investigation, which concluded on September 15. The organization filed breach notifications with regulators in Maine and began notifying affected individuals, offering two years of identity protection services to those impacted. The Play ransomware group, which has been active since 2022, has been linked to over 900 attacks globally, including dozens of high-profile incidents targeting various sectors. The incident at Dairy Farmers of America is part of a broader trend, with the food and agriculture sector experiencing 84 ransomware attacks in the first quarter of 2025 alone, more than double the number from the same period the previous year. Despite the growing threat, recent bipartisan Senate legislation aimed at improving cyber defenses for the food and agriculture industry has not been enacted. The breach underscores the increasing use of advanced social engineering tactics by ransomware groups to target critical infrastructure and highlights the ongoing vulnerability of the food supply chain to cyber threats. Dairy Farmers of America did not respond to media requests for further comment regarding the incident. The attack has raised concerns about the resilience of essential services and the need for enhanced cybersecurity measures across the agricultural sector. Regulatory scrutiny is expected to increase as a result of the breach, with potential implications for industry-wide security standards. The incident serves as a stark reminder of the risks posed by ransomware to organizations managing sensitive personal and financial data.
Jun 29, 2026