Lion (Beverage giant) Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 09, 2020, the ransomware group revil listed Lion, described as a beverage company, on its data-leak site. The entry states that internal files were taken during a ransomware incident, though the organisation has not issued a public statement confirming the details or the extent of any access. The number of people whose information may be involved is not known, and no independent verification of the claimed data has been released.

Inside the incident

Public records show only that Lion appeared on the revil leak site on the reported date. The group asserts that internal files were exfiltrated, but no information has been published about the method of entry, the volume of data, or whether encryption was also deployed against Lion systems.

Timing of the underlying operation, any ransom demand, and the current status of the files remain undisclosed. No law-enforcement confirmation or company disclosure has supplemented the leak-site listing.

The group behind it: revil

revil, also tracked publicly as Sodinokibi, is a ransomware operation that has conducted multiple campaigns since 2019. Its documented pattern involves gaining access to corporate networks, exfiltrating data, and then encrypting systems before posting samples or lists on a dedicated leak site when negotiations fail.

The group has previously claimed responsibility for incidents affecting organisations in manufacturing, professional services and local government. Its listings function as a pressure tactic; the accuracy of each claim varies and requires separate verification.

Lion (Beverage giant) and its sector

Lion operates in the beverage production and distribution sector, a supply chain that routinely manages supplier contracts, logistics records, formulation data and customer or partner information. Such entities maintain large volumes of operational records that can include both commercial and personal data.

A claimed compromise in this sector draws attention because production and distribution networks often connect to third-party vendors, increasing the potential downstream reach of any stolen material.

What was likely exposed

The only detail released is that internal files were taken. The precise categories of data have not been published, so the contents cannot be confirmed.

Organisations of this type commonly store employee records, customer or distributor contact details, financial documentation and operational files. Whether any of these categories are present in the claimed exfiltration is unverified.

The real-world impact

Individuals named in any internal files face the standard risks associated with exposed corporate records: potential misuse for targeted phishing or identity-related fraud. The absence of confirmed data types makes it impossible to quantify the scale of that exposure.

For the organisation, the listing adds to the operational burden of investigating the claimed access, notifying regulators where required, and managing any follow-on inquiries from partners or customers.

Were you affected?

Because the exact data set has not been disclosed, individuals cannot yet determine whether their information is involved. The following steps provide a practical starting point while further details remain unavailable:

• Review recent correspondence from Lion or its subsidiaries for any official notification.
• Monitor bank and credit accounts for unusual activity.
• Run a free exposure scan of your email address against known breach data sets to check for prior appearances of your information.
• Consider placing fraud alerts with credit agencies if you have had direct dealings with the company.

AICompiled with AI assistance from public sources and published under our editorial standards.