Vinovalie

Summary

A cooperative winery experienced a ransomware attack compromising its global information system, with hackers demanding a $450,000 ransom. The organization refused payment, confirming no sensitive customer data was exfiltrated due to functional backup protocols. The incident disrupted operations, paralyzing most activities except logistics, physical stores, and online sales; 150 workstations required disinfection while servers underwent restoration. Employee productivity halted, raising partial unemployment concerns, though bottling operations aimed to resume promptly. National gendarmerie, insurance experts, and financial partners assisted in investigating the breach and recovery efforts, with delivery delays occurring despite unaffected transaction systems. A complaint was filed against unknown perpetrators.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 25-26, 2023, Vinovalie's cooperative experienced a cyberattack that compromised its global information system. The intrusion occurred overnight and was detected early on October 26, paralyzing most operations except physical stores and the e-commerce platform. Attackers encrypted workstations across the network, blocking 150 computers and disabling email communications. They demanded a $450,000 ransom payable within seven days, though one source alternatively cited the amount as 450,000 euros. The attack coincided with a 50% reduction in annual harvest yields, leading Vinovalie to publicly refuse payment. Immediate operational disruptions left 190 employees unable to work, raising concerns about potential partial unemployment. Logistics operations resumed by October 27, allowing shipment of previously processed orders, but delivery schedules experienced delays. No customer data exfiltration occurred according to company statements.

Vinovalie initiated containment by filing a criminal complaint with French gendarmerie and collaborating with insurance forensic teams and financial institution cybersecurity units. IT teams prioritized server restoration and system disinfection, leveraging regular backup protocols though recovery timelines remained uncertain. CEO Jacques Tranier targeted October 30 for restarting bottling operations. The investigation focused on identifying the initial infection vector that enabled network compromise. Business impacts included complete email system failure, forcing the company to publicly advise clients and suppliers about communication disruptions. While online sales transactions continued unaffected, all non-logistical backend operations remained suspended during remediation efforts. The cooperative maintained public assurances about data security measures and service quality despite ongoing operational constraints.

Sources

Sources available to members: 2 sources.