HP Hood LLC

Summary

A cybersecurity incident disrupted operations at a major New England dairy supplier, prompting the company to take all plants offline temporarily as a precaution. This halted manufacturing and raw material intake, including milk deliveries. While most facilities resumed operations following around-the-clock efforts by the IT team, the disruption caused anticipated milk shortages affecting regional school districts. One district reported substituting juice or water for milk in meals due to expected delivery and ordering impacts. The company maintained communication with affected customers throughout the incident, which remained under investigation.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around March 12, 2022, HP Hood LLC experienced a cybersecurity event that disrupted operations across its dairy production network. The Lynnfield, Massachusetts-based company took all manufacturing plants offline as a precautionary measure following the incident, suspending production and halting the receipt of raw materials including milk. Company spokesperson Lynne Bohan confirmed the shutdown lasted through the weekend, with Hood’s IT team and other personnel working continuously to restore systems. By March 18, most facilities had resumed operations, though the investigation into the incident remained ongoing. The disruption prevented Hood from fulfilling standard manufacturing and supply chain processes during the outage period.

The cyber incident impacted Hood’s role as a primary dairy supplier to New England schools and other customers. The ConVal School District in Peterborough, New Hampshire, anticipated milk shortages due to Hood’s disrupted ordering and delivery systems, as communicated by its foodservice vendor. Superintendent Kimberly Rizzo Saunders stated that juice or water would substitute for milk in most meals for at least a week following the attack. Hood’s sales, customer service, and procurement teams maintained direct communication with affected clients throughout the disruption. No further details regarding the attack vector, threat actor, or data compromise were disclosed in public statements. The company prioritized restoring operational capacity while assessing the event’s full scope.

Sources

Sources available to members: 1 source.