Fresca Listed by nokoyawa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In early May 2023, the UK fruit-and-vegetable supplier Fresca appeared on the leak site operated by the ransomware group nokoyawa. Public reporting at the time stated that the group claimed to have exfiltrated roughly 100 GB of internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published.

For a business that sits in the middle of the UK fresh-produce supply chain, any confirmed exposure of internal material raises practical questions for staff, trading partners and anyone whose details may have been stored in corporate systems. What follows summarises only what has been reported and places it in context.

What happened

On or around 4 May 2023, Fresca was listed by the nokoyawa ransomware group. According to the group’s own statement accompanying the listing, Fresca Group is a large privately owned supplier of fruit and vegetables headquartered in Kent, United Kingdom, and the attackers claimed they had “successfully downloaded ~100 GB of private data.” The listing framed the incident as a ransomware attack in which internal files were exfiltrated. No public technical timeline, initial access method, or confirmed encryption event has been released by Fresca or by independent investigators. The precise volume, exact file inventory and whether systems were also encrypted remain unverified beyond the group’s claim.

The group behind it: nokoyawa

Nokoyawa is a ransomware operation that has been active in the public threat landscape for several years. Like many contemporary ransomware crews, it typically follows a double-extortion model: data are copied out of the victim environment before encryption, and the threat of publication is used to pressure payment. The group has previously posted victim names and sample files on dedicated leak sites, a pattern consistent with the Fresca listing. Public reporting has associated nokoyawa with opportunistic targeting across multiple sectors rather than a single industry focus. No statement from nokoyawa beyond the leak-site claim about Fresca has been corroborated in open sources, and the listing itself should be treated as an unverified assertion by the attackers.

About Fresca

Fresca Group, founded in 2004 and based in Kent, is described in the attackers’ own text as one of the largest privately owned suppliers of fruit and vegetables in the United Kingdom. Organisations of this type sit between growers, importers, packers and major retailers. They routinely handle commercial contracts, logistics data, quality and traceability records, employee information and supplier or customer contact details. Because fresh-produce supply chains are time-sensitive and heavily regulated for food safety, disruption or unauthorised disclosure of internal material can affect both day-to-day operations and regulatory obligations. A breach claim against such a company is therefore consequential even when the exact contents of any stolen archive remain unconfirmed.

The information in question

The only data description provided in public reporting is “internal files exfiltrated in [a] ransomware attack,” together with the group’s claim of approximately 100 GB. No itemised list of document types, databases or personal-data categories has been released by Fresca or by independent sources. Companies in the fresh-produce wholesale and distribution sector commonly hold payroll and HR records, supplier and customer contracts, invoices, transport schedules, product specifications and internal correspondence. Whether any of those categories were present in the material nokoyawa claims to hold has not been independently verified. Until a fuller disclosure or official notification appears, the precise contents must be regarded as unconfirmed.

Why it matters

If internal files were copied, individuals whose details appear in HR, payroll or contractor records could face risks of phishing, identity misuse or unwanted contact. Trading partners whose commercial terms or contact data were stored internally may see that information used in social-engineering attempts. For Fresca itself, the incident raises the ordinary post-ransomware concerns: potential regulatory notification duties under UK data-protection law, contractual obligations to customers and suppliers, and the operational cost of investigation and remediation. Because the number of affected people is unknown and the file inventory is undisclosed, the concrete scale of harm cannot yet be measured; the risk remains real but bounded by what is actually known.

If your data was in this claimed breach

Anyone who has worked for, supplied or traded with Fresca and is concerned that their information may have been involved should treat unsolicited messages with extra caution, monitor financial and email accounts for unusual activity, and consider placing fraud alerts with relevant UK services if personal identifiers were likely held. Changing passwords on any accounts that reused credentials associated with work email is a sensible immediate step. Official confirmation from the company, if and when it is issued, should be followed for specific guidance. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets, which provides an additional early-warning signal while details of this incident remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.