Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Food/Beverages

Breach intelligence, attack campaigns, and threat reports targeting the Food/Beverages sector.

29 threat reports
Page 1 of 3
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Food/Beverages Threat Reports

Showing 1–12 / 29 reports
When Hackers Target Blood: The 2026 EFS Refrigeration Cyberattack and the OT Supply-Chain Crisis
When Hackers Target Blood: The 2026 EFS Refrigeration Cyberattack and the OT Supply-Chain Crisis
Health Care / Life Sciences4 days ago

When Hackers Target Blood: The 2026 EFS Refrigeration Cyberattack and the OT Supply-Chain Crisis

On November 2, 2026, France's national blood service (Établissement français du sang, EFS) suffered an indirect cyberattack when threat actors exploited a vulnerability in third-party remote monitoring software used by refrigeration supplier Coolworld Rentals. The attackers manipulated temperature and defrost settings across cold-storage chambers at three EFS facilities, threatening plasma bags and biological samples. EFS monitoring systems detected the anomaly rapidly, enabling staff to transfer or secure all products; no blood loss or health impact was reported. ANSSI and the French Ministry of Health are actively investigating. This incident is part of a documented wave of ICS/OT attacks targeting refrigeration controllers across Europe—including more than 465 retail cold-chain sites struck in October–November 2026—exploiting Danfoss and Dixell XWEB remote management interfaces (CVE-2025-41450, CVE-2025-41451). The pattern confirms that OT supply-chain compromise via internet-exposed third-party remote monitoring components is an escalating, cross-sector threat with direct life-safety consequences.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
European Grocery Chains Hit by Massive Refrigeration System Cyberattack
European Grocery Chains Hit by Massive Refrigeration System Cyberattack
Retail Industry3 weeks ago

European Grocery Chains Hit by Massive Refrigeration System Cyberattack

In October 2026, cybercriminals exploited unpatched vulnerabilities in Danfoss and XWEB refrigeration controllers across over 400 European grocery stores, converting refrigerators and freezers into heating units that reached 50°C (120°F). The attackers manipulated defrost cycles to mask the sabotage, causing complete spoilage of perishable inventory and estimated losses exceeding several million euros. The attacks leveraged CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affecting end-of-life Danfoss AK-SM 800A platforms, along with 23 vulnerabilities in XWEB Pro systems disclosed by Claroty researchers in August 2026. This incident highlights the growing threat to operational technology (OT) environments where legacy industrial control systems remain Internet-exposed and unpatched. As critical infrastructure increasingly relies on connected IoT devices for remote monitoring and control, attackers are shifting focus from traditional IT networks to industrial systems that can cause immediate physical and financial damage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
French Supermarket Cyberattack Exposes Critical IoT Security Gaps in Connected Refrigeration Systems
French Supermarket Cyberattack Exposes Critical IoT Security Gaps in Connected Refrigeration Systems
Supermarkets3 weeks ago

French Supermarket Cyberattack Exposes Critical IoT Security Gaps in Connected Refrigeration Systems

In October 2026, cybercriminals targeted connected refrigeration systems across French supermarket chains, exploiting vulnerabilities in older Danfoss IoT units that could not receive security updates. Attackers gained control of temperature regulation software and forced freezers to heat up to 50°C (120°F) overnight, far exceeding normal defrost cycles. The attack caused significant food spoilage, supply chain disruption, and financial losses for multiple retail chains while exposing the widespread security risks of legacy IoT infrastructure in critical operations. This incident highlights the growing threat landscape around unsecured IoT devices as attackers increasingly target operational technology and smart infrastructure. With millions of legacy connected devices deployed across retail, healthcare, and industrial sectors lacking update capabilities, organizations face mounting pressure to address IoT security gaps before they become entry points for disruptive cyberattacks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
French Supermarket Cyberattack Exposes Critical IoT/OT Security Gaps
French Supermarket Cyberattack Exposes Critical IoT/OT Security Gaps
Retail Industry3 weeks ago

French Supermarket Cyberattack Exposes Critical IoT/OT Security Gaps

On October 11, 2026, attackers remotely compromised hundreds of French supermarkets by hijacking Danfoss refrigeration controllers, heating fridges and freezers to temperatures as high as 50°C. The attack affected major chains including Intermarché, Carrefour, and Coopérative U, forcing stores to discard millions of euros worth of food products. Attackers exploited vulnerabilities in older, unpatched Danfoss AK-SM and AK-SC controller models that were directly exposed to the internet without proper network segmentation or access controls. This unprecedented IoT/OT attack demonstrates the critical vulnerability of industrial control systems when proper cybersecurity measures are absent, highlighting the urgent need for better segmentation and lifecycle management of operational technology devices in retail infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition
International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition
Automotive1 month ago

International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition

In October 2026, Germany arrested a Russian national suspected of being a core member of the notorious Qilin ransomware group following extradition from Japan. The suspect was originally detained in May 2026 at an Osaka hotel after entering Japan as a tourist, where German authorities had issued an international arrest warrant. Qilin, operating as a ransomware-as-a-service (RaaS) since 2022, has targeted over 2,350 organizations across 62 countries, including major victims like Nissan, Asahi Brewery, and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Despite the arrest, the group remained highly active, listing over 450 new victims since June 2026. This arrest highlights the growing international law enforcement cooperation against ransomware operations and demonstrates that RaaS leaders can be tracked and prosecuted across borders. The continued activity of Qilin post-arrest underscores the distributed nature of modern ransomware operations and the persistent threat they pose to critical infrastructure worldwide.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
BigCommerce Ribon App Breach: How Third-Party Integrations Became the New Attack Vector
Retail Industry1 month ago

BigCommerce Ribon App Breach: How Third-Party Integrations Became the New Attack Vector

In September 2026, attackers compromised credentials for Ribon third-party applications on the BigCommerce platform, operated by Be A Part Of (a Fastr company). Between September 13-17, the threat actors used stolen API keys to inject malicious scripts into merchant storefronts and access customer data including names, email addresses, phone numbers, and shipping addresses. BigCommerce immediately removed the compromised applications and notified affected merchants, with companies like Master of Malt confirming exposure of shopper information. While BigCommerce's core platform remained secure, the incident demonstrates the expanding attack surface created by third-party integrations in e-commerce ecosystems. This supply chain compromise highlights the growing trend of attackers targeting less-secured vendor applications to reach high-value customer databases, particularly as organizations increasingly rely on SaaS integrations for enhanced functionality.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
PayRange API Vulnerability Exposes Critical Payment Infrastructure
Consumer Goods2 months ago

PayRange API Vulnerability Exposes Critical Payment Infrastructure

A critical vulnerability (CVE-2026-18965) in PayRange's API system exposes sensitive information from payment kiosks and vending machines across North America. The missing authorization flaw allows both authenticated and unauthenticated attackers to access verbose details of every device on the PayRange network, potentially enabling denial of service attacks and unauthorized device manipulation. The vulnerability affects all versions of the PayRange API, with PayRange reportedly unresponsive to CISA's coordination efforts. This incident highlights the growing security risks in Internet of Things (IoT) payment systems as critical infrastructure increasingly relies on connected devices. The vulnerability demonstrates how API security gaps can expose entire networks of payment devices, particularly relevant as organizations face mounting regulatory pressure to secure payment processing systems and protect consumer data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Massive Azure Data Breach: 3.6 Million Records Allegedly Stolen
Information Technology/IT2 months ago

Massive Azure Data Breach: 3.6 Million Records Allegedly Stolen

In August 2026, a threat actor known as "TheHatman" claimed to have stolen 3.64 million employee records from multiple Fortune 500 companies by exploiting compromised credentials to access their Microsoft Azure infrastructures. The stolen data reportedly includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and other tenant account records. Companies allegedly affected include McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, and Kyndryl. Some organizations have disputed the claims, stating that the data appears outdated and that no credible evidence of a breach was found. This incident underscores the persistent threat posed by credential-based attacks and highlights the importance of robust authentication mechanisms. The use of techniques such as password spraying and Multi-Factor Authentication (MFA) fatigue attacks demonstrates the evolving tactics of cybercriminals targeting cloud infrastructures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
ShinyHunters Sextortion Email Scam Exploits Leaked Data in July 2026
Financial Services3 months ago

ShinyHunters Sextortion Email Scam Exploits Leaked Data in July 2026

In July 2026, threat actors exploited email addresses exposed in data breaches attributed to the ShinyHunters extortion group to launch a sextortion email campaign. These emails, falsely claiming to be from ShinyHunters, alleged that recipients' devices were compromised, and demanded $2,000 in Bitcoin to prevent the release of purportedly sensitive information. The campaign utilized data from breaches of companies such as Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. However, investigations revealed no evidence that the senders had actual access to recipients' devices or personal data. This incident underscores the persistent threat posed by cybercriminals repurposing leaked data for malicious activities. Organizations and individuals must remain vigilant against such social engineering tactics, as the misuse of exposed information continues to fuel sophisticated scams aimed at extorting victims.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chick-fil-A Data Breach 2026: Credential Stuffing Attack Compromises Customer Accounts
Restaurants3 months ago

Chick-fil-A Data Breach 2026: Credential Stuffing Attack Compromises Customer Accounts

In June 2026, Chick-fil-A experienced a credential stuffing attack targeting its website and mobile application. Between June 17 and June 19, unauthorized parties used previously compromised credentials to access Chick-fil-A One loyalty accounts. The breach exposed sensitive customer information, including names, email addresses, membership numbers, mobile pay numbers, partial payment card digits, and potentially birth dates, phone numbers, and addresses. In total, 13,322 individuals were affected across multiple states. Chick-fil-A responded by logging out impacted accounts, removing stored payment methods, restoring account balances, and issuing additional rewards to affected customers. This incident underscores the persistent threat of credential stuffing attacks, which exploit reused or compromised credentials to gain unauthorized access to user accounts. The recurrence of such attacks highlights the critical need for organizations to implement robust security measures, including mandatory multi-factor authentication and proactive monitoring, to protect customer data and maintain trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Nichirei Cyberattack: A Wake-Up Call for Supply Chain Security
Food Production3 months ago

Nichirei Cyberattack: A Wake-Up Call for Supply Chain Security

In July 2026, Nichirei Corporation, a leading Japanese frozen food and logistics company, experienced a significant cyberattack attributed to the RansomHouse group. The attack disrupted operations across approximately 140 distribution centers, affecting major clients like Kentucky Fried Chicken Japan, which faced ingredient shortages and operational challenges. The breach led to system failures, particularly in refrigerated warehouse and frozen food shipping services, causing widespread supply chain disruptions. Nichirei collaborated with external cybersecurity firms and authorities to investigate and mitigate the incident, aiming to fully resume operations by the end of the week. This incident underscores the escalating threat of ransomware attacks targeting critical supply chains, highlighting the need for robust cybersecurity measures and incident response strategies. Organizations must prioritize securing their digital infrastructures to prevent similar disruptions and protect sensitive data from malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Chick-fil-A Credential Stuffing Attack Exposes Customer Data
Restaurants3 months ago

Chick-fil-A Credential Stuffing Attack Exposes Customer Data

In June 2026, Chick-fil-A experienced a credential stuffing attack targeting its website and mobile application. Between June 17 and June 19, unauthorized parties used account credentials obtained from third-party sources to access certain Chick-fil-A One accounts. The breach potentially exposed customers' names, email addresses, membership numbers, mobile pay numbers, QR codes, Chick-fil-A credit balances, and the last four digits of credit/debit card numbers. Additional information such as birth dates, phone numbers, and addresses may have also been accessed if stored in the compromised accounts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/?utm_source=openai)) This incident underscores the persistent threat of credential stuffing attacks, which exploit reused or compromised credentials across multiple platforms. Organizations must implement robust security measures, including multi-factor authentication and continuous monitoring, to mitigate such risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports