America’s second largest egg producer breached, claim hackers

Rose Acre Farms, a top US egg producer, has been claimed by a prominent cybercrime cartel, with the attackers saying that they’ve encrypted the company’s data. Past attacks on major agricultural producers led to shortages and price hikes.

The attack was claimed by the notorious Lynx ransomware cartel, which posted the company on its dark web blog. The specific underground website is exclusively used to showcase Lynx’s latest victims.

We have reached out to the company for comment and will update the article once we receive a reply.

Red Acre Farms is a major egg producer in the United States with facilities in numerous states. The egg producer’s estimated revenue is close to $700 million while staff numbers exceed 2,000. In the past, the company’s eggs were sold at US retail behemoth Walmart, and are now most likely sold at Aldi.

Meanwhile, the attackers claim that the Rose Acre Farms data breach took place late last week, when they penetrated the company’s networks. Typically for Lynx ransomware, they did not immediately provide samples of the stolen data, only noting that the company’s data was encrypted and proof will be provided later.

Ransomware can disrupt prices

According to the Cybernews research team, such attacks can be devastating for companies that don’t have usable backups. In the worst case scenario, encryption can lead to disruptions in operation and production. The stakes are especially high for food producers like Rose Acre Farms, as undelivered food items can quickly spoil, causing severe financial losses.

“Such attacks can cause financial losses for the victim, and in this case, may also cause market fluctuations due to decreased supply. Which, in turn, may affect product availability and pricing to end users,” our researchers explained.

“Such attacks can cause financial losses for the victim, and in this case, may also cause market fluctuations due to decreased supply. Which, in turn, may affect product availability and pricing to end users,”

researchers explained.

For example, a 2021 ransomware attack on JBS, the world’s largest meat processing company, raised prices and threatened the whole meat supply chain in the US. Another 2021 attack against the Colonial Pipeline caused price hikes after America's largest fuel pipeline had to shut down production for nearly a week.

Meanwhile, last week's attack on the luxury automaker Jaguar Land Rover forced the British automaker to shut down its systems, causing “severe disruptions to its retail and production activities.”

Who’s behind the alleged Rose Acre Farms data breach?

First noticed in mid-2024, Lynx ransomware gang is typical ransomware-as-a-service (RaaS) operation. RaaS gangs operate by selling access to encryption malware that’s deployed by so-called affiliates. After a successful attack, affiliates split the ransom money with malware developers.

Attackers operate by breaching company systems with the intent to steal and encrypt data. If the victims don’t meet ransom demands, the malicious actors threaten to release the stolen data and keep systems encrypted – a costly endeavour for businesses that rely on products delivered on time.

Some researchers believe that the Lynx ransomware cartel is an offshoot or a rebrand attempt of individuals related to the notorious INC Ransom cartel.

According to Ransomlooker, Cybernews’ dark web monitoring tool, Lynx has victimized over 200 organizations over the previous 12 month period.