Holly Poultry Data Breach

Holly Poultry, a company engaged in poultry farming and food processing, was identified on the Settra ransomware group’s leak site on October 2, 2026. Settra claims to have exfiltrated sensitive corporate data from the organization. For companies within the food manufacturing sector, the risks associated with such an incident extend beyond mere data exposure. Disruptions to critical operational systems, such as production scheduling, food safety monitoring, or cold-chain logistics, can lead to significant regulatory and supply continuity challenges that are distinct from typical IT security incidents. Over the past 60 days, the Settra ransomware group has demonstrated a consistent pattern of targeting mid-market manufacturing and food production companies. The data typically exfiltrated from a poultry processor would likely encompass sensitive commercial information, including regulatory compliance records, contracts with suppliers and distributors, and details pertaining to cold chain logistics. The public release of such commercially sensitive material under the pressure of double extortion tactics can severely damage client relationships, independent of any ransom payment.

SOCRadar’s investigation involved a query of stealer-log data, which returned no confirmed credential hits specifically for Holly Poultry. This absence of direct evidence from stealer logs does not preclude a compromise. Instead, it suggests that the initial access vector may not have been commodity credential theft. The probable entry path for threat actors may lie in alternative methods, such as phishing campaigns or the exploitation of internet-facing enterprise resource planning (ERP) systems or specialized logistics platforms. These methods are more likely to facilitate an intrusion than the acquisition of commodity credentials found in stealer logs. For the food industry, it is imperative to implement robust security measures. This includes segregating food safety monitoring systems from general enterprise IT networks. Furthermore, maintaining verified offline backups of critical production scheduling and compliance records is essential. These measures should be considered baseline requirements, not aspirational goals, to mitigate the impact of potential ransomware attacks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.