{ "id": "e349d2b0-cee7-4791-88cc-e2d4b5145e0a", "created_at": "2026-04-06T00:15:53.085145Z", "updated_at": "2026-04-10T13:13:10.210745Z", "deleted_at": null, "sha1_hash": "b8e1bf5f3c35f35e9f56c93187a0e6cde125d909", "title": "KP Snacks giant hit by Conti ransomware, deliveries disrupted", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 4385731, "plain_text": "KP Snacks giant hit by Conti ransomware, deliveries disrupted\r\nBy Ax Sharma\r\nPublished: 2022-02-02 · Archived: 2026-04-05 13:12:08 UTC\r\nKP Snacks, a major producer of popular British snacks has been hit by the Conti ransomware group affecting distribution to\r\nleading supermarkets.\r\nKenyon Produce (KP) Snacks includes popular brands such as PopChips, Skips, Hula Hoops, Penn State pretzels, McCoy's,\r\nWheat Crunchies, etc.\r\nKP Snacks has more than 2,000 employees and estimates put the company's annual revenue at over $600 million, making\r\nthem an attractive target for threat actors.\r\nhttps://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nConti plans to leak sensitive documents\r\nA cyber attack on British snack giant, KP Snacks has now escalated to supply chain disruption around the UK.\r\nBecause of the attack, deliveries from the company to leading superstores are reportedly being delayed or canceled\r\naltogether. According to discussions between KP Snacks and its partner supermarkets, the supply shortage issues can last\r\nuntil the end of March.\r\nLetter sent by KP Snacks to supermarkets like Nisa (betterRetailing)\r\nA source informed BleepingComputer that the company's internal network had been breached with threat actors gaining\r\naccess to and encrypting sensitive files, including employee records and financial documents.\r\nPrivate leak pages seen by BleepingComputer show Conti ransomware group claiming responsibility for the attack:\r\nhttps://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/\r\nPage 3 of 5\n\nKP Snacks listed on Conti's private data leak page (BleepingComputer)\r\nOn the private leak page, Conti shared samples of credit card statements, birth certificates, spreadsheets with employee\r\naddresses and phone numbers, confidential agreements, and other sensitive documents.  \r\nDarknet intel provider DarkFeed had also posted yesterday about Conti ransomware op giving the company five days\r\nbefore leaking even more proprietary data on their public blog.\r\nIt isn't clear if KP Snacks is currently negotiating with Conti or if it will pay a ransom.\r\n\"On Friday, 28 January we became aware that we were unfortunately victims of a ransomware incident,\" a KP Snacks\r\nspokesperson told BleepingComputer.\r\n\"As soon as we became aware of the incident, we enacted our cybersecurity response plan and engaged a leading forensic\r\ninformation technology firm and legal counsel to assist us in our investigation.\"\r\nThe company's internal IT teams are working with third party security experts to assess the situation.\r\n\"We have been continuing to keep our colleagues, customers, and suppliers informed of any developments and apologise for\r\nany disruption this may have caused,\" concluded the company in their statement to us.\r\nConti repeatedly hits high-profile organizations\r\nConti is a Ransomware-as-a-Service (RaaS) operation linked to the Wizard Spider Russian cybercrime group, also known\r\nfor other notorious malware, including Ryuk, TrickBot, and BazarLoader.\r\nThe ransomware group's affiliates breach targets' networks after corporate devices get infected with BazarLoader or\r\nTrickBot malware, providing them remote access to the compromised system.\r\nIn recent weeks, Conti has rapidly climbed up the ranks among ransomware groups after repeatedly targeting prominent\r\norganizations.\r\nLast month, Conti claimed responsibility for attacking Bank Indonesia, the country's central bank, and began\r\nleaking its data.\r\nIn December 2021, Conti had breached the systems of Nordic Choice hotel group, freezing the hotel properties' key cards.\r\nhttps://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/\r\nPage 4 of 5\n\nThe ransomware gang's former targets have included Ireland's Department of Health (DoH) and Health Service\r\nExecutive (HSE), and marketing giant RR Donnelly (RRD).\r\nDue to increased Conti activity, the FBI, CISA, and the NSA US have also recently issued an advisory warning of\r\nan increased number of Conti ransomware attacks.\r\nUpdate Feb 3, 01:35 AM ET: Added a copy of the letter sent by KP Snacks to partner supermarkets.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/\r\nhttps://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.bleepingcomputer.com/news/security/kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted/" ], "report_names": [ "kp-snacks-giant-hit-by-conti-ransomware-deliveries-disrupted" ], "threat_actors": [], "ts_created_at": 1775434553, "ts_updated_at": 1775826790, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/b8e1bf5f3c35f35e9f56c93187a0e6cde125d909.pdf", "text": "https://archive.orkl.eu/b8e1bf5f3c35f35e9f56c93187a0e6cde125d909.txt", "img": "https://archive.orkl.eu/b8e1bf5f3c35f35e9f56c93187a0e6cde125d909.jpg" } }