Qilin Group Ransomware Strikes Refreshment Services Pepsi
Ransomware Attack on Refreshment Services Pepsi by Qilin Group
On January 18, 2025, Refreshment Services Pepsi (RSI), a prominent independent bottler and distributor of PepsiCo products, allegedly fell victim to a ransomware attack orchestrated by the Qilin ransomware group. This incident underscores the vulnerabilities faced by companies in the consumer services sector, particularly those managing extensive data networks.
Company Profile and Industry Standing
Refreshment Services Pepsi, established in 1934, operates seven distribution centers across the central and southern United States. With its headquarters in Springfield, Illinois, the company serves over 4,000 retail locations and 2,000 vending and foodservice accounts. RSI is recognized for its comprehensive service approach, offering not only a wide range of beverages and snacks but also equipment maintenance and innovative solutions to business customers. The company's commitment to social and corporate responsibility has earned it accolades, including being named PepsiCo's 2021 Donald M. Kendall Bottler of the Year.
Attack Overview
The Qilin ransomware group, known for its sophisticated Ransomware-as-a-Service model, claimed responsibility for the attack on RSI. The group provided six screenshots as evidence of the breach, threatening to release all company data on January 24, 2025. This attack highlights the ongoing threat posed by ransomware groups to enterprises handling large volumes of sensitive data.
Qilin Ransomware Group
Qilin, also known as Agenda, emerged in July 2022 and has since become a significant player in the ransomware landscape. The group distinguishes itself through its use of double extortion tactics, encrypting and exfiltrating data to pressure victims into paying ransoms. Qilin's ransomware is highly customizable, allowing affiliates to tailor attacks to specific targets. The group typically gains access through spear phishing and exploiting vulnerabilities in systems like Citrix ADC and VMware ESXi.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!