Listen to this Post
Cybercrime Escalates: Qilin and Everest Target Food Sector Giants
In a growing wave of cyberattacks, two notorious ransomware groups—Qilin and Everest—have expanded their dark web operations by targeting food industry companies. On July 29, 2025, the ThreatMon Threat Intelligence Team reported that Custom Food Ingredients fell victim to a ransomware attack orchestrated by Qilin. Just two days later, on July 31, 2025, Everest published a full data leak after successfully breaching Crumbl, a prominent brand in the gourmet cookie sector.
This information was flagged through monitoring activities focused on ransomware groups active on the dark web. These attacks not only compromise sensitive data but also disrupt operations in critical supply chains like food production and retail. The breaches highlight the growing brazenness of ransomware actors and their willingness to publicly expose stolen data when victims refuse to comply with extortion demands.
🔎 the Cyber Assault
According to a post from ThreatMon Ransomware Monitoring, Qilin launched a ransomware attack on Custom Food Ingredients at 17:53 UTC+3 on July 29, 2025. Though limited technical details were made public, this attack is part of Qilin’s ongoing pattern of targeting supply chain-sensitive organizations. Their goal is typically to exfiltrate confidential data and encrypt internal systems, demanding hefty ransoms in exchange for decryption keys and non-disclosure.
Just 48 hours later, another major breach made headlines. On July 31 at 14:50 UTC+3, Everest published the full leak of stolen data from Crumbl, a high-profile company known for its premium cookie franchises across the U.S. This time, the attackers did not wait for negotiations or payments—they dumped the full data on the dark web, making it accessible to cybercriminals, competitors, and malicious actors worldwide.
These incidents reflect a dangerous evolution in ransomware tactics. The attackers are no longer just locking up data—they’re exposing it with zero hesitation. This escalates pressure on companies to meet ransom demands quickly or suffer reputational damage, regulatory penalties, and potential lawsuits.
💻 What Undercode Say:
Ransomware Is No Longer Just a Tech Issue—It’s an Operational Crisis
From a cybersecurity
1. Sector Specialization:
Both companies belong to the food sector—a domain not traditionally seen as a high-priority target. However, the interconnected nature of food supply chains makes them highly vulnerable. Disruption in logistics, food safety data, and inventory systems can lead to immediate financial loss.
2. Psychological Warfare:
Publishing a “full leak” like Everest did with Crumbl sends a strong message to future targets: pay or be exposed. This tactic weaponizes fear, targeting not just systems but executive decision-making processes.
3. Increased Sophistication:
Groups like Qilin and Everest aren’t just deploying ransomware—they’re deploying it with finesse. They often spend weeks inside networks (using tactics like lateral movement and privilege escalation) before launching the attack, maximizing damage.
4. Public Relations Pressure:
By leaking victim names via social media platforms like X (formerly Twitter), threat actors are creating their own PR channels. This forces companies into the public eye before they’re prepared to respond, giving cybercriminals more leverage.
5. Missed Cyber Hygiene:
Smaller or mid-sized enterprises like Custom Food Ingredients often lack the cybersecurity maturity seen in tech giants. Inadequate network segmentation, outdated patches, and weak endpoint defenses remain common vulnerabilities exploited by these groups.
6. Reputational Fallout:
Crumbl’s brand—built on trust and premium experiences—is now tainted by the association with leaked customer or internal data. In food industries where brand loyalty is everything, such breaches can cripple business continuity.
7. Geopolitical Ties:
Everest and Qilin have suspected ties to state-backed cybercrime ecosystems, particularly from Eastern Europe and Asia. Their organized infrastructures and financial channels make them especially dangerous.
8. Regulatory Wake-Up Call:
After such high-profile attacks, regulators are likely to introduce stricter compliance requirements for cybersecurity in the food and retail sectors. That means more audits, higher insurance premiums, and mandatory breach disclosures.
9. Crisis Communication Gap:
These companies must now navigate crisis PR, legal fallout, and customer trust rebuilding—all while possibly negotiating with criminals. Having no plan in place can cost millions in recovery.
10. A Glimpse into the Future:
Expect more ransomware gangs to follow suit. Once they realize that the food industry yields valuable data (supply chains, recipes, customer databases), the floodgates could open further.
✅ Fact Checker Results
✅ Qilin attack on Custom Food Ingredients confirmed via ThreatMon (July 29, 2025).
✅ Everest full leak on Crumbl publicly published (July 31, 2025).
✅ All data originated from verified dark web monitoring by ThreatMon.
🔮 Prediction 🔥
As ransomware tactics evolve, sectors once considered “low-risk” like food, education, and small retail will become top targets. Threat actors will prioritize companies with poor cyber hygiene but high data value. Expect more full-data leaks, faster leak cycles, and real-time dark web broadcasts as part of future ransomware strategies. Businesses that lack robust cybersecurity frameworks will be the first to fall.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: x.com
Extra Source Hub:
https://www.instagram.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
