Liberty Gold Fruit Listed by sinobi Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 23, 2025, the ransomware group sinobi listed Liberty Gold Fruit on its leak site and claimed responsibility for a ransomware attack that included the exfiltration of internal files. The number of individuals affected has not been disclosed, and no further details on the volume or contents of the material have been made public. This development reflects a pattern in which ransomware operators continue to target mid-sized companies in essential supply chains, using data theft alongside encryption to increase leverage during negotiations.

Breaking down the breach

Public information about the incident remains limited to the leak-site listing. The group asserts that internal files were removed during a ransomware operation, but the date of the intrusion, the duration of access, and the scale of the data removal have not been confirmed by any independent source. No statement from Liberty Gold Fruit addressing the listing or claiming the claims has been referenced in available reports.

Inside sinobi

Sinobi is one of several ransomware groups that maintain dedicated leak sites to publish data they claim to have stolen from victims who refuse ransom demands. These actors commonly gain initial access through phishing, compromised remote-access services, or third-party vendors, then move laterally to locate and copy files before deploying encryption. The listing of Liberty Gold Fruit constitutes the group’s claim of involvement; independent verification of the underlying intrusion has not been published.

Liberty Gold Fruit and its sector

Liberty Gold Fruit Company, Inc. is a privately held, family-owned processor and distributor of food products that has operated since 1932. Its LIGO brand reaches retail shelves in approximately 40 countries, primarily across Asia, Central America, and Europe. Companies of this type maintain records related to production schedules, supplier contracts, shipping logistics, quality-control documentation, and employee information necessary to run international distribution networks.

The information in question

The only data category named in connection with the incident is “internal files.” The precise composition of those files has not been disclosed. Food-production and distribution firms routinely store operational documents, financial records, personnel files, and customer or partner correspondence; whether any of these categories were among the exfiltrated material remains unconfirmed.

Why it matters

Exposure of internal operational files can reveal details about supply-chain relationships and production methods that competitors or other actors might exploit. If employee or partner contact information is present, individuals could face increased phishing or social-engineering attempts. For the organization, the incident adds the costs of investigation, potential regulatory notifications, and remediation even if the full scope of the data remains unclear.

Were you affected?

Because the number of individuals whose information may be involved is unknown, anyone who has conducted business with Liberty Gold Fruit or worked at the company should monitor their email and financial accounts for unusual activity. A practical first step is to review recent statements from banks and credit providers and to enable multi-factor authentication on any accounts that may be linked to the company. Readers can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.