Custom Food Ingredients Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Custom Food Ingredients has been listed by the ransomware group known as qilin, according to reports dated May 23, 2025. Public detail remains limited: the number of people affected is unknown, and the only confirmed description of exposed material is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group rather than an independently verified confirmation of compromise.

For a company that supplies tailored food solutions to businesses in the food-service sector, any unauthorized access to internal files raises practical questions about operational data, supplier relationships and the personal or commercial information that may have been held. This article sets out only what is known so far and the broader context that helps ordinary readers assess potential impact.

What happened

On or around May 23, 2025, Custom Food Ingredients appeared on a leak site associated with the qilin ransomware group. The available reporting states that internal files were exfiltrated as part of a ransomware attack. No further public detail has been released about the precise date of intrusion, the initial access method, the volume of data taken, or whether encryption of systems also occurred. The number of individuals whose information may have been involved remains unknown. Because the sole source of the claim is the group’s own listing, the incident should be treated as alleged until the organisation or independent investigators provide additional confirmation.

The group behind it: qilin

Qilin is a well-documented ransomware operation that has been active for several years. Like many contemporary groups, it typically follows a double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to pressure victims into paying. The group has operated as a ransomware-as-a-service platform, allowing affiliates to deploy its tools in exchange for a share of any ransom. Public reporting has linked qilin to attacks across multiple sectors, including manufacturing, logistics and professional services. Its leak sites are used both to name victims and, in some cases, to publish sample files as proof of access. In this instance the group claims to have listed Custom Food Ingredients and to have exfiltrated internal files; no additional statements or sample data specific to this victim have been independently verified in the available record.

About Custom Food Ingredients

Custom Food Ingredients, also referred to in reporting as Custom Food Group, specialises in providing tailored food solutions for a diverse range of clients. Its focus is customisation: developing and supplying food products designed to meet the specific needs of businesses in the food-service and related industries. Organisations of this type commonly maintain detailed product formulations, supplier contracts, customer order histories, quality-control records and employee or contractor information. Because the company sits in the middle of food-supply chains, a breach can affect not only its own staff and direct customers but also downstream restaurants, manufacturers or distributors that rely on its ingredients and formulations. The consequential nature of the incident therefore stems less from consumer retail data and more from the commercial and operational sensitivity of the material such a firm typically holds.

What was likely exposed

The only data type named in the available facts is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of those files, no file counts, and no confirmation of specific categories such as employee records, customer lists or proprietary recipes have been publicly disclosed. Organisations in the custom food-ingredient sector ordinarily store product specifications, pricing agreements, shipping and logistics data, quality-assurance documentation, and personal information relating to employees and business contacts. Whether any of those categories were among the files taken remains unconfirmed. Readers should treat all statements about exact contents as speculative until the company or regulators release a verified inventory.

Why it matters

For individuals whose details may appear in the internal files—employees, contractors, or business contacts—the practical risks include targeted phishing, social-engineering attempts that reference real company relationships, and, in some cases, identity-related fraud if personal identifiers were present. For the organisation itself, the exposure of proprietary formulations or commercial agreements can create competitive and contractual difficulties, while any disruption to production or logistics systems can affect customers further down the supply chain. Because the scale of the incident is unknown, the full extent of these risks cannot yet be measured. The absence of confirmed numbers does not eliminate the possibility of harm; it simply means that affected parties must rely on caution rather than precise notification lists for the time being.

Were you affected?

If you have worked for, contracted with, or supplied Custom Food Ingredients, monitor financial and email accounts for unexpected activity and treat unsolicited messages that reference the company with heightened scepticism. Consider placing fraud alerts with credit bureaus if you believe personal identifiers may have been involved. You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Until the company publishes a formal notice or data inventory, these steps remain the most practical immediate measures available to individuals.

AICompiled with AI assistance from public sources and published under our editorial standards.