Loading story…
Dairy Farmers of America, a major Kansas-based farmer-owned dairy cooperative, suffered a significant ransomware attack in June, which was later claimed by the Play ransomware group. The attack resulted in unauthorized access to the cooperative's systems, leading to the theft of sensitive personal information belonging to 4,546 individuals. The compromised data included names, dates of birth, Social Security numbers, bank account details, driver's license or state-issued ID numbers, and Medicare or Medicaid numbers. The breach affected both employees and members of the cooperative, which is responsible for marketing and selling milk and related products from its 9,500 farmer-owners and employs approximately 19,000 people. The organization reported $24.5 billion in revenue in 2022 and is responsible for producing about 23% of all U.S. milk, highlighting the potential impact of the attack on the broader food and agriculture sector. The attackers gained access to the network through a sophisticated social engineering campaign, which enabled them to bypass security controls and begin exfiltrating data shortly after the initial compromise. Dairy Farmers of America discovered the breach two days after the attack began and subsequently launched an internal investigation, which concluded on September 15. The organization filed breach notifications with regulators in Maine and began notifying affected individuals, offering two years of identity protection services to those impacted. The Play ransomware group, which has been active since 2022, has been linked to over 900 attacks globally, including dozens of high-profile incidents targeting various sectors. The incident at Dairy Farmers of America is part of a broader trend, with the food and agriculture sector experiencing 84 ransomware attacks in the first quarter of 2025 alone, more than double the number from the same period the previous year. Despite the growing threat, recent bipartisan Senate legislation aimed at improving cyber defenses for the food and agriculture industry has not been enacted. The breach underscores the increasing use of advanced social engineering tactics by ransomware groups to target critical infrastructure and highlights the ongoing vulnerability of the food supply chain to cyber threats. Dairy Farmers of America did not respond to media requests for further comment regarding the incident. The attack has raised concerns about the resilience of essential services and the need for enhanced cybersecurity measures across the agricultural sector. Regulatory scrutiny is expected to increase as a result of the breach, with potential implications for industry-wide security standards. The incident serves as a stark reminder of the risks posed by ransomware to organizations managing sensitive personal and financial data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Following the breach disclosure, Dairy Farmers of America said it would provide two years of identity protection services to affected individuals. The offer was part of its response to the exposure of sensitive personal data.
Dairy Farmers of America disclosed in breach notifications, including a filing with Maine regulators, that 4,546 individuals were affected. The notices said exposed data included Social Security numbers, driver's license or state ID numbers, dates of birth, bank account numbers, and Medicare or Medicaid numbers.
The Play ransomware operation was identified as claiming the Dairy Farmers of America incident. The claim linked the June breach to a known prolific ransomware group.
Dairy Farmers of America said it finished its investigation on September 15, 2025. The investigation determined that stolen data included highly sensitive personal, financial, and health-related identifiers.
The cooperative reported that it discovered the unauthorized activity two days after the attack started. This indicates the compromise was identified shortly after the initial June intrusion.
Dairy Farmers of America said a ransomware-related intrusion began in June 2025 after attackers used a sophisticated social engineering campaign to gain access and exfiltrate data. The incident affected employee and cooperative member information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026
Several major organizations in the healthcare and insurance sectors have disclosed significant data breaches affecting millions of individuals. ARC Community Services reported a ransomware attack by the INC Ransom group, resulting in the exfiltration of sensitive patient data, including health and financial information. Aflac confirmed that a June cyberattack led to the theft of files containing insurance claims, health data, and Social Security numbers for over 22 million customers, with no operational disruption but widespread exposure of personal information. The Louisiana Office of Student Financial Assistance (LOSFA) notified students of unauthorized access to its systems, exposing names and Social Security numbers, though certain savings accounts were not affected. Oklahoma Spine Hospital agreed to a $1.1 million settlement following a July breach that compromised the data of nearly 39,000 patients, including medical and financial details. These incidents highlight the ongoing threat posed by cybercriminals targeting sensitive data in the healthcare and insurance industries. Victims in these breaches are being offered credit monitoring and identity protection services, and regulatory notifications have been issued. The attacks have prompted legal action, regulatory scrutiny, and, in some cases, leadership changes within affected organizations. Law enforcement and cybersecurity experts have been engaged to investigate and mitigate the impact of these breaches, which are part of a broader trend of targeted attacks against organizations handling large volumes of personal and health-related information.
Jun 29, 2026
The University of Hawaiʻi Cancer Center confirmed a **ransomware-driven data breach** affecting its epidemiology division, with the potential exposure of data tied to up to **1.2 million individuals**. The university reported that attackers accessed files containing **SSNs and driver’s license numbers** sourced from historical Hawaiʻi DOT records and Honolulu voter registration data (dating back to 1998), as well as health-related research data connected to the **Multiethnic Cohort (MEC) Study** and other diet-and-cancer studies; the incident was discovered on **August 31, 2025**, and the university acknowledged it engaged with the threat actors while restoration and impact assessment were underway. Separately, a “cyber incident” caused a **five-school-day internet outage** at the Denmark School District in Wisconsin; the **INC Ransom** group claimed the victim on its leak site, alleging both **encryption** and theft of roughly **70.76 GB** of data, though the district had not publicly confirmed ransomware or data exfiltration. In the healthcare sector, **Insight Hospital and Medical Center** in Chicago reported unauthorized network access between **August 22 and September 11, 2025**, and the **Termite** group later claimed to have stolen and then **leaked ~360 GB** (about 900,000 files) of “confidential data,” including medical imaging files (e.g., `.dcm`), raising the likelihood of exposure of both identity data and protected health information.
Jun 29, 2026