CONFERENCE CISO Forum Virtual Summit 2026 - View all Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Ransomware Disrupts Production at Australian Beverage Company Lion

Australian beverages company Lion reported this week that its systems have been infected with a piece of ransomware that caused disruptions to manufacturing processes and customer service.

Australian beverages company Lion reported this week that its systems have been infected with a piece of ransomware that caused disruptions to manufacturing processes and customer service.

Lion is a major supplier of beer and milk in Australia and New Zealand. The company revealed on June 9 that it had shut down its IT systems as a result of a “cyber incident,” causing disruption to customers and suppliers. It then confirmed on June 12 that it was hit by ransomware.

The brewer said it was able to continue producing beer during the lockdowns triggered by the COVID-19 crisis and it had been planning on increasing production, but those plans have been delayed due to the cyberattack.

The company was forced to shut down some manufacturing sites as a result of the incident — some of them are still offline — and customers have been warned that the incident could result in “temporary shortages.”

“Our teams are working as hard as they can to service customers and suppliers, implementing new manual processes and investigating all alternative options. We recognise this is imperfect and is causing disruption to our valued partners. We also recognise this is happening at an unfortunate time as we emerge from COVID-19 restrictions,” the company stated.

“We had been hoping to have full access restored by now, but unfortunately this process is taking longer than we hoped,” Lion said on Friday.

Advertisement. Scroll to continue reading.

The company claims it has found no evidence that personal, financial or other type of information has been stolen from its systems as a result of the breach, but its investigation is ongoing.

A similar statement was made recently by Australian shipping giant Toll after being hit by Nefilim ransomware, but the organization later admitted that some data was in fact stolen. The hackers who conducted the attack have already started leaking files stolen from Toll — hundreds of gigabytes of financial and other information has been made public — after the company refused to pay the ransom.

SecurityWeek has reached out to Lion to find out which ransomware family was involved in the attack. This article will be updated if the company responds.

Japanese car maker Honda was also hit by ransomware recently and the company admitted that the incident impacted production operations at some plants in the United States.

Related: Vulnerability in Mitsubishi Controllers Can Allow Hackers to Disrupt Production

Related: Australian Steel Maker BlueScope Hit by Cyberattack

Related: Researchers Analyze Entry Points, Vectors for Manufacturing System Attacks

Written By

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Click to comment

You must be logged in to post a comment Login

Leave a Reply

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

NOW LIVE: CISO Forum 2026 Summit

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

Join to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.

Register

People on the Move

Cohere has appointed Jaya Baloo as CISO.

Jensen Huang has resigned as President and Chief Executive Officer at NVIDIA.

Sean Sweeney has become CIO of the City of Charleston, South Carolina.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.