Cyber Incident Victim: Arla Foods
Date:
May 2025
Location:
Germany
Summary
Arla Foods reported a cybersecurity incident at its plant in the German town of Upahl, where suspicious activity was detected on the IT network. As a precaution, production was halted and security measures were implemented, prompting the company’s IT and production teams to work on restoring normal operations. It has begun systematically restarting systems to return the site to full functionality while declining to provide further details.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
An Arla Foods plant in the German town of Upahl experienced a cybersecurity incident that the company confirmed involved suspicious activity on its cooperative IT network. Arla stated that, as a result of the security measures put in place after the detection, production at the facility was affected. The company’s production and IT experts began working diligently to resume normal operations and initiated a systematic restart of the systems to restore full functionality. Arla declined to provide further details when approached for comment by Just Food. The incident disrupted normal workflow at the site while the organization focused on containment and recovery efforts.
Arla’s German operations are a significant part of its business, with sales in Germany reaching €1.27 billion ($1.42 billion) in 2024, an increase of 1.5 % compared with the previous year, making Germany the company’s third‑largest market after the United Kingdom and Sweden. In 2024 Arla’s group revenues totaled €13.8 billion ($14.39 billion), up from €13.7 billion in 2023. The cooperative employed 1,635 staff in Germany during 2024, contributing to a total global headcount of 23,632. Last month Arla announced plans to merge with DMK, the largest dairy cooperative in Germany, a move described by both parties as creating the largest dairy cooperative in Europe with members across Denmark, Sweden, the United Kingdom, Germany, Belgium, Luxembourg and the Netherlands; the combined pro‑forma revenue was projected to be €19 billion ($20.75 billion) and the new entity would retain the Arla name and be headquartered in Denmark. DMK reported 2024 revenue of €5.1 billion, down from €5.5 billion the prior year, and owns brands such as Milram, Oldenburger, Uniekaas, Alete Bewusst and Humana. A Rabobank report from August 2023 ranked Arla as the seventh‑largest dairy group worldwide based on 2023 financials, while DMK was placed eighteenth.
Separately, last week the German beer and soft‑drinks company Oettinger Getränke disclosed that it was investigating a cyberattack on its systems, confirmed a breach and said it was examining the potential for data leaks. According to the cybersecurity publication Cybernews, the ransomware group Ransom House claimed to have obtained data from the brewer. The article does not connect the Oettinger Getränke incident or the Ransom House claim to the Arla Foods event.