Skip to content
🛡️ SecOps

Qilin Claims Sysco on Ransomware Leak Site — World's Largest Food Distributor Faces Deadline

Qilin ransomware operators have listed Sysco Corporation — the world's largest foodservice distribution company — on their dark web extortion site, claiming to hold data extracted from the company's networks. Sysco has not confirmed a breach. The listing appears amid an 80 per cent rise in ransomware pressure against the food and beverage sector in Q2 2026.

3 min read
#qilin#ransomware#sysco#food-sector#critical-infrastructure#data-extortion#supply-chain
Article security-operations

Qilin ransomware operators added Sysco Corporation to their dark web extortion site with a data publication deadline, claiming to hold proprietary data extracted from the company’s networks. Sysco, headquartered in Houston, Texas, is the world’s largest broadline foodservice distribution company with annual revenues exceeding USD 76 billion, serving approximately 725,000 customers in 90 countries including restaurants, healthcare facilities, educational institutions, and government entities.

The Qilin Ransomware Group

Qilin (also tracked as “Agenda”) has operated since 2022 and has accelerated its victim count through 2025 and into 2026. The group is distinguished by several operational characteristics:

BYOVD (Bring Your Own Vulnerable Driver): Qilin has used legitimate but vulnerable driver files to disable EDR software before deploying ransomware. This technique, detailed in reporting from earlier in 2026, allowed them to disable up to 300 security tools on victim networks.

Cross-platform capability: Qilin payloads exist for both Windows (including Hyper-V ESXi virtualisation) and Linux (targeting VMware ESXi), enabling simultaneous encryption of virtualised server infrastructure.

Double extortion model: The group steals data before encrypting it, listing non-paying victims on a Tor-based leak site with countdown timers to publication of exfiltrated data.

Why Sysco Matters Beyond Its Size

Sysco’s role in food supply chain infrastructure gives a successful breach ramifications beyond financial loss:

Supply chain visibility: Sysco holds data on purchasing relationships, supply volumes, and supplier contracts for hundreds of thousands of food service operators. Exfiltration of this data would expose commercial intelligence across the food service industry.

Healthcare and institutional supply: Sysco supplies hospitals, schools, prisons, and military facilities. Disruption to order management or supply logistics — through ransomware-induced outage — could cascade into food supply problems for vulnerable populations.

Regulatory exposure: As a supplier to US federal government institutions, Sysco is subject to federal contractor data handling requirements. A confirmed breach would trigger mandatory reporting obligations.

Sector Pattern

The Sysco listing follows a broader pattern of ransomware focus on food and beverage distribution. This sector has historically been underinvested in cybersecurity relative to the criticality of its infrastructure. Operational technology (OT) environments in food processing and distribution — warehouse management systems, refrigeration monitoring, logistics platforms — are frequently air-gapped from corporate IT in principle but connected in practice, creating pathways from IT compromise into operational systems.

The 80 per cent year-on-year increase in ransomware incidents targeting food and beverage in Q2 2026, tracked by multiple threat intelligence services, reflects both the sector’s attractiveness as a target (critical infrastructure, time-sensitive operations, ransomware leverage) and the relative immaturity of its security posture compared to financial services or healthcare.

Sysco’s direct customers and logistics partners should:

  • Review their dependency on Sysco’s digital order management and EDI systems, and confirm whether business continuity plans cover a multi-day Sysco system outage
  • Contact their Sysco account representative to request a statement on the security of their shared business data
  • Monitor for any Sysco communications about a breach in the coming days
  • If Sysco holds personal data on your employees (through corporate catering accounts or similar), review your GDPR/data breach notification obligations for third-party processor incidents

Share this article

Related Intelligence

🛡️ SecOps

Foxconn Confirms Nitrogen Ransomware Attack on North American Factories — 8 TB of Customer Data Stolen

Electronics manufacturing giant Foxconn confirmed a Nitrogen ransomware attack on its North American operations that encrypted factory systems and exfiltrated approximately 8 TB of data including Apple, NVIDIA, and Intel supply chain documentation. Production lines at multiple facilities were disrupted before recovery procedures were activated.

#ransomware +4
🛡️ SecOps

Qilin and Warlock Ransomware Deploy BYOVD Technique to Disable 300+ EDR Tools Before Encryption

Cisco Talos and Trend Micro have documented that Qilin and Warlock ransomware operations are now using the Bring Your Own Vulnerable Driver (BYOVD) technique to systematically disable endpoint detection and response software before deploying ransomware payloads. The technique exploits a legitimate but outdated signed kernel driver to terminate over 300 EDR products from virtually every security vendor — including CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, and Carbon Black.

#ransomware +7
🛡️ SecOps

Qilin Ransomware Posts Record 131 Victims in March — Third Consecutive Month Above 100

Qilin ransomware posted 131 confirmed victims in March 2026, its highest monthly total since emerging as a major ransomware-as-a-service operation. This marks three consecutive months above 100 victims — a sustained tempo that no tracked ransomware group has previously achieved. Healthcare, manufacturing, and professional services bear the heaviest burden, with the US accounting for half of all March ransomware victims across all groups.

#ransomware +5