Loading story…
A large-scale distributed denial-of-service (DDoS) attack targeted Russia’s Federal Service for Veterinary and Phytosanitary Surveillance (Rosselkhoznadzor), severely disrupting the agency’s critical information systems, including VetIS and Saturn. The attack rendered the Mercury platform, which is essential for issuing electronic veterinary certificates, temporarily unavailable, halting the movement of agricultural products and chemicals across the country. Major dairy and baby food producers reported hours-long delays, as they were unable to obtain the mandatory documentation required for legal shipment of meat, milk, and other animal products. The agency confirmed that there was no compromise of data integrity or confidentiality, and mitigation efforts were underway with support from major Russian telecom providers.
The disruption led to significant financial losses for suppliers and forced some to negotiate with retail chains for emergency shipment procedures. While Rosselkhoznadzor stated that the Mercury system was operating normally by the following day, the incident highlighted the vulnerability of Russia’s food supply chain to cyberattacks. No hacker group has claimed responsibility for the attack, and this marks at least the fourth such incident targeting the Mercury system in 2025. The agency and affected companies are reviewing emergency protocols to prevent future disruptions of this scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Following the attack on Rosselkhoznadzor, product shipment processing was disrupted, leading to delays and reported halts affecting food shipments across Russia.
Russia's food safety agency, Rosselkhoznadzor, was reportedly targeted in a distributed denial-of-service attack that disrupted its systems and operations.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack disrupted operations at **Vladimir Bread Factory**, a major bakery producer in Russia’s Vladimir region, after attackers hit the company’s internal digital environment overnight on Sunday. The incident knocked out office IT, including computers, servers, electronic document management tools, and the widely used **1C** enterprise accounting system, forcing the company to revert to **manual order and shipment processing** and move office staff to a round-the-clock schedule. While production lines and bakeries reportedly continued operating at full capacity, the outage significantly complicated order processing and deliveries, contributing to localized delivery failures and temporary shortages of the company’s bakery products. The attacker identity and incident type (e.g., ransomware vs. other intrusion) were not confirmed, and the company did not provide a timeline for full restoration of affected systems. Reporting also noted this incident in the context of broader cyber-related disruptions in Russia’s food sector, including a prior attack that disabled the country’s animal-based product certification platform (triggering paper-based workarounds and logistics delays) and a separate ransomware incident affecting a large dairy processing plant in southern Siberia in early 2025, which local media speculated may have been linked to the plant’s reported support for Russian troops in Ukraine (without official attribution).
Jun 29, 2026
Dairy Farmers of America, a major Kansas-based farmer-owned dairy cooperative, suffered a significant ransomware attack in June, which was later claimed by the Play ransomware group. The attack resulted in unauthorized access to the cooperative's systems, leading to the theft of sensitive personal information belonging to 4,546 individuals. The compromised data included names, dates of birth, Social Security numbers, bank account details, driver's license or state-issued ID numbers, and Medicare or Medicaid numbers. The breach affected both employees and members of the cooperative, which is responsible for marketing and selling milk and related products from its 9,500 farmer-owners and employs approximately 19,000 people. The organization reported $24.5 billion in revenue in 2022 and is responsible for producing about 23% of all U.S. milk, highlighting the potential impact of the attack on the broader food and agriculture sector. The attackers gained access to the network through a sophisticated social engineering campaign, which enabled them to bypass security controls and begin exfiltrating data shortly after the initial compromise. Dairy Farmers of America discovered the breach two days after the attack began and subsequently launched an internal investigation, which concluded on September 15. The organization filed breach notifications with regulators in Maine and began notifying affected individuals, offering two years of identity protection services to those impacted. The Play ransomware group, which has been active since 2022, has been linked to over 900 attacks globally, including dozens of high-profile incidents targeting various sectors. The incident at Dairy Farmers of America is part of a broader trend, with the food and agriculture sector experiencing 84 ransomware attacks in the first quarter of 2025 alone, more than double the number from the same period the previous year. Despite the growing threat, recent bipartisan Senate legislation aimed at improving cyber defenses for the food and agriculture industry has not been enacted. The breach underscores the increasing use of advanced social engineering tactics by ransomware groups to target critical infrastructure and highlights the ongoing vulnerability of the food supply chain to cyber threats. Dairy Farmers of America did not respond to media requests for further comment regarding the incident. The attack has raised concerns about the resilience of essential services and the need for enhanced cybersecurity measures across the agricultural sector. Regulatory scrutiny is expected to increase as a result of the breach, with potential implications for industry-wide security standards. The incident serves as a stark reminder of the risks posed by ransomware to organizations managing sensitive personal and financial data.
Jun 29, 2026
Russian security systems provider **Delta** said it was hit by a cyberattack that disrupted services used in commercial facilities, private homes, and automobiles. Reports said customers experienced widespread failures in vehicle security functions, including cars that would not start, alarms that could not be turned off, and vehicles that could not be opened, while some users were told recovery might require dealer reflashing. At the same time, Delta’s website was unavailable and its phone lines were reportedly unreachable, compounding the outage. The incident drew concern because Delta’s products are used for remote protection and access control, raising the prospect of broad operational disruption for customers. Delta confirmed the cyberattack to Russian media, but no actor had been publicly identified, and there was no confirmed evidence of a personal data leak despite customer fears that account or vehicle-related information may have been exposed.
Jun 29, 2026