Ransomware Attack on EPI Breads: Play Group Compromises Data
Incident Date:
August 29, 2024
Overview
Title
Ransomware Attack on EPI Breads: Play Group Compromises Data
Victim
Epi Breads
Attacker
Play
Location
First Reported
August 29, 2024
Ransomware Attack on EPI Breads by Play Ransomware Group
EPI Breads, a prominent custom bakery in the United States, has recently fallen victim to a ransomware attack orchestrated by the Play ransomware group. The attack has compromised sensitive and private information, including personal documents, tax records, identification details, and other confidential data, posing significant risks to the privacy and security of the affected individuals and the company's operations.
About EPI Breads
Founded in 1985, EPI Breads LLC is a leading custom bakery specializing in a wide variety of bread products tailored to meet the specific needs of restaurants and retail chains. With over 30 years of experience, the company offers an extensive range of products, including hoagies, sub rolls, sliced loaves, artisan breads, and gluten-free options. EPI Breads operates a significant baking facility in Atlanta, spanning 176,000 square feet, which includes multiple production lines aimed at expanding its product offerings. The company employs around 224 individuals and reported an annual revenue of approximately $30.6 million.
Attack Overview
The Play ransomware group, also known as PlayCrypt, has claimed responsibility for the attack on EPI Breads via their dark web leak site. The attackers have infiltrated the company's systems, compromising sensitive data and potentially disrupting their operations. The breach highlights vulnerabilities in EPI Breads' cybersecurity measures, making them a target for sophisticated threat actors.
About Play Ransomware Group
Active since June 2022, the Play ransomware group has been responsible for numerous high-profile attacks across various industries, including IT, transportation, construction, and critical infrastructure. The group employs various methods to gain entry into networks, such as exploiting RDP servers, FortiOS vulnerabilities, and Microsoft Exchange vulnerabilities. They use tools like Mimikatz for privilege escalation and custom tools to enumerate users and computers on compromised networks. Play ransomware is known for its minimalistic ransom notes, directing victims to contact the threat actors via email.
Penetration Methods
The Play ransomware group could have penetrated EPI Breads' systems through several vectors, including exploiting vulnerabilities in RDP servers or Microsoft Exchange, using valid accounts, or leveraging custom tools to disable antimalware solutions. The group's sophisticated tactics and techniques make them a formidable threat to organizations with insufficient cybersecurity measures.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.