Cyber Incident Victim: B&G Foods
Date:
Feb 2023
Location:
United States of America
Summary
B&G Foods experienced a cyberattack by the Daixin Team involving the encryption of approximately 1,000 hosts and subsequent exfiltration of internal files, which were later leaked on a dark web site. The attackers claimed the victim did not engage in negotiations despite multiple contact attempts, leading to the disclosure of documents including sensitive employee information such as medical assessments, incident reports, birthdays, and contact details, though the leak lacked extensive corporate or personnel records. The incident disrupted operations, but the company reportedly opted not to pay a ransom, with no confirmation on whether systems were restored via backups or decryption.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around February 4, 2023, the Daixin Team cybercriminal group executed a ransomware attack against B&G Foods, a California-based multibillion-dollar food company with brands including Crisco, Green Giant, and Cinnamon Toast Crunch. The attackers encrypted approximately 1,000 hosts within B&G’s network and exfiltrated internal company files. Daixin Team representatives confirmed to DataBreaches.net that they initiated encryption on February 4 and attempted to contact B&G through notes left on the local network and multiple communications. The company did not engage in negotiations or respond through the attackers’ designated communication channel, leading Daixin Team to speculate that B&G might have prioritized system restoration without paying ransom. While the attackers were uncertain whether they had encrypted all backups, they suggested B&G could potentially recover systems independently.
The stolen data appeared on Daixin Team’s dark web leak site and included internal corporate documents, though the group characterized the breach as less significant compared to their other operations. Leaked files contained employee benefit details, birth months and days (without years), and cellphone numbers. Sensitive personnel records were confirmed in the dump, including a medical assessment request for an employee with severe sleep apnea and a confidential investigation report detailing a contractor found unconscious at a job site due to suspected drug abuse. B&G Foods did not respond to DataBreaches.net’s inquiries regarding operational disruptions, decryption capabilities, or backup restoration efforts. The company’s lack of public communication extended to addressing potential impacts on employees whose personal and medical information was exposed. No further details about containment measures, system recovery timelines, or regulatory notifications were disclosed by B&G or corroborated in available sources as of the article’s publication date.