Arla Foods targeted by hackers, product operations disrupted

A factory of Arla Foods in Germany has been targeted in a cyberattack. Customers have been informed about possible delivery delays and cancellations.

Arla Foods is a Swedish-Danish dairy producer and farmer-owned cooperative with over 12,500 members. Lurpak, Puck, Starbucks, and Castello are a few of Arla’s strategic brands across the globe. The company’s revenue increased to €13.8 billion ($15.6 billion) in 2024, and it obtained a net profit of €401 million ($454 million). Arla Foods employs over 23,000 people in 39 countries.

A spokesperson for Arla Foods has acknowledged that the company noticed “suspicious activity” on its IT network in a plant in the German town of Upahl.

“Due to the security measures implemented as a result of the incident, production has been affected. Our production and IT experts are working diligently to resume normal operations at the site, and we have now begun the process of systematically restarting the systems to ensure a return to full functionality,” the spokesperson told online publication Just Food.

A lot of questions remain unanswered. For example, we don’t know who’s responsible for the cyberattack, how the threat actor managed to gain access to the company’s IT network, whether corporate data was exfiltrated or not, and if any ransom demands were made.

What we do know is that the cyberattack was limited to the plant in Upahl and that the incident caused production to halt. A spokesperson told BleepingComputer that customers have been notified about possible delivery delays and order cancellations, and that production operations at other Arla sites aren’t affected.

The dairy company refuses to share any additional information at this time.