Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa Listed by lorenz Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In the broader landscape of ransomware operations that pair encryption with data theft and public leak-site pressure, industrial and food-production firms have repeatedly appeared as targets. On 5 April 2023, Joy Cone Co, Joy Baking Group, BoDeans Baking and Altesa were listed on the Lorenz ransomware group’s leak site. The group claims to have stolen internal data; the number of people affected remains unknown and public detail on the intrusion itself is limited.

The listing is an unverified claim by the actors. What is confirmed in open reporting is only that the organisations were named and that Lorenz asserted exfiltration of internal files. No independent confirmation of the full scope, method or exact timeline has been supplied in the available record.

Inside the incident

According to the public record, Joy Cone Co, Joy Baking Group, BoDeans Baking and Altesa appeared on the Lorenz leak site on or about 5 April 2023. Lorenz stated that it had conducted a ransomware attack and exfiltrated internal files. No further technical particulars—initial access vector, dwell time, encryption status, ransom demand or negotiation outcome—have been disclosed in the material available. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s own claim that internal data were taken, the precise contents, volume and any subsequent publication of those files remain unconfirmed in open sources.

Inside lorenz

Lorenz is a ransomware operation that has been active for several years and is documented as using a double-extortion model: systems are encrypted while copies of data are removed and later threatened with public release if payment is not made. The group maintains a Tor-based leak site on which it posts victim names, sample files and, in some cases, larger archives. Public reporting on Lorenz has described the use of common initial-access techniques such as phishing, exploitation of exposed remote-access services and the deployment of commodity or custom ransomware payloads. The group has previously listed organisations across manufacturing, professional services and other sectors. In the present case the only specific assertion tied to these victims is the leak-site listing itself and the accompanying claim of stolen internal data; no additional statements unique to this incident are part of the public record used here.

About Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa Listed by lorenz Ransomware Group

Joy Cone Co is a long-established United States manufacturer of ice-cream cones and related baked goods; Joy Baking Group, BoDeans Baking and Altesa are associated entities operating in the same or adjacent segments of the commercial baking and food-production industry. Companies of this type typically maintain manufacturing facilities, supply-chain relationships with retailers and distributors, employee records, customer and vendor contracts, product formulations, quality and safety documentation, and the ordinary financial and operational files required to run multi-site production. Because they sit inside the food supply chain, a disruption or data exposure can affect not only the firms themselves but also downstream customers and, indirectly, consumers. A ransomware incident that includes claimed data theft therefore raises questions about both operational continuity and the confidentiality of business and personnel information.

What was likely exposed

The only data type named in the available facts is “internal files” said to have been exfiltrated in a ransomware attack. Exact file inventories, record counts and categories have not been disclosed. Organisations in commercial baking and food manufacturing commonly hold:

• Employee personnel and payroll records
• Vendor, supplier and customer contracts and contact details
• Production schedules, recipes, quality-control and food-safety documentation
• Financial, shipping and inventory data
• Internal correspondence and operational planning materials

Whether any or all of these categories were among the files Lorenz claims to have taken is unconfirmed. Readers should treat the precise contents as unknown until corroborated by the organisations or by independent analysis of any released material.

Why it matters

For individuals, the principal risks centre on the possible exposure of personal or employment-related information that could be misused for identity fraud, targeted phishing or social-engineering attempts. Even when the full data set is not public, the mere assertion that internal files were stolen can create lasting uncertainty for staff and partners. For the organisations, the incident carries operational, contractual and reputational consequences: production or logistics systems may have been disrupted, contractual notification duties to customers or regulators may apply, and trust with suppliers and retailers can be affected. Because the number of people affected is unknown and the exact data types remain unverified, the practical impact cannot yet be quantified; the prudent stance is to assume that sensitive internal material may have left the companies’ control and to monitor for secondary misuse.

If your data was in this claimed breach

If you are a current or former employee, contractor or business partner of Joy Cone Co, Joy Baking Group, BoDeans Baking or Altesa, treat the Lorenz claim as a prompt for basic hygiene rather than confirmed proof that your records were taken. Change passwords on work-related and personal accounts that may have shared credentials, enable multi-factor authentication where available, and watch financial and email accounts for unexpected activity. Be alert to phishing messages that reference the companies or the incident. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. If you receive notice directly from the organisations, follow the specific guidance they provide; until then, the steps above remain the most practical immediate actions.

AICompiled with AI assistance from public sources and published under our editorial standards.