Connect with us

Hi, what are you looking for?



Food Giant Kraft Heinz Targeted by Ransomware Group

A ransomware group claims to have breached the systems of Kraft Heinz, but the food giant says it’s unable to verify the claims. 

Ransomware Report

A known ransomware group claims to have breached the systems of Kraft Heinz, but the food giant says it’s unable to verify the cybercriminals’ allegations.

The ransomware group named Snatch publicly named Kraft Heinz on its website on December 14, but the post appears to have been created on August 16, which indicates that the attack occurred months ago. 

Indeed, in a statement issued on Thursday, Kraft Heinz said it’s investigating claims of a cyberattack that occurred several months ago. The company said the target appeared to be a decommissioned marketing site hosted on an external platform, but it’s currently unable to verify the hackers’ claims.

“Our internal systems are operating normally, and we currently see no evidence of a broader attack,” Kraft Heinz said. 

The cybercriminals have yet to publish any files as proof of their claims. 

Kraft Heinz is one of the world’s biggest food and beverage companies, with roughly 37,000 employees worldwide. The company owns more than 20 brands, including Kraft, Heinz, Boca Burger, Gevalia, Grey Poupon, Oscar Mayer, Philadelphia Cream Cheese, Primal Kitchen, and Wattie’s.

The Snatch ransomware operation has been around since mid-2021, targeting various types of organizations in countries such as the United States, United Kingdom, France and India, including in critical infrastructure sectors.

However, the US government said in a recent report that the individuals behind the operation may have been active since at least 2018, with evidence pointing to links to other well-known ransomware operations. 

The group typically encrypts files on the targeted organization’s systems, and also steals data that it threatens to leak in order to increase the chances of getting paid. Its leak website currently names more than 120 alleged victims. 

Advertisement. Scroll to continue reading.

It was discovered a few months ago that Snatch’s site had been leaking data related to its internal operations, as well as the IPs of visitors. 

Related: Mozilla Warns of Fake Thunderbird Downloads Delivering Ransomware 

Related: Johnson Controls Ransomware Attack Could Impact DHS

Related: Cybersecurity Companies Report Surge in Ransomware Attacks

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


A SaaS ransomware attack against a company’s Sharepoint Online was done without using a compromised endpoint.


Several major organizations are confirming impact from the latest zero-day exploits hitting Fortra's GoAnywhere software.

Data Breaches

Sony shares information on the impact of two recent unrelated hacker attacks carried out by known ransomware groups. 

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.


Alphv/BlackCat ransomware group files SEC complaint against MeridianLink over its failure to disclose an alleged data breach caused by the hackers.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.