Perrigo Company Listed by termite Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 14, 2025, Perrigo Company was listed by the ransomware group known as termite. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further operational details have not been disclosed.

The listing itself constitutes a claim by the group rather than independent confirmation of every asserted detail. For a global healthcare supplier and manufacturer of private-label over-the-counter pharmaceuticals, any confirmed exposure of internal material raises practical questions about operational continuity and the potential reach of the data involved.

What happened

According to available public information, Perrigo Company appeared on a listing associated with the termite ransomware group on March 14, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No public figures have been released for the volume of data taken, the precise date of initial access, the method of intrusion, or the number of individuals whose information may have been involved. Timing, scale, and technical specifics beyond the fact of the listing and the description of internal-file exfiltration remain undisclosed.

As with many ransomware incidents, the group's leak-site claim is the primary public signal. Independent verification of the full scope has not been detailed in the available record, and organizations in such situations often continue internal investigation and notification processes after an initial listing appears.

The group behind it: termite

Termite is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while also claiming to steal data and threatening to publish it if demands are not met. Like other groups in this category, termite typically posts victim names and sample claims on dedicated leak sites to apply pressure. Public reporting on the group has described it as relatively recent in the ransomware landscape, with activity focused on corporate targets across multiple sectors.

In this instance the group claims to have listed Perrigo Company and to have exfiltrated internal files. No additional statements attributed specifically to termite about this victim—such as ransom amounts, file counts, or publication deadlines—appear in the provided facts. Established patterns for such groups include opportunistic targeting, use of common initial-access vectors when available, and public posting of claims rather than immediate full data dumps. Those general tactics are well documented for termite and similar actors; they do not constitute Reported Details of the Perrigo incident itself.

Who is Perrigo Company?

Perrigo Company was founded in 1887 and is headquartered in Dublin, Ireland. It operates as a global healthcare supplier and manufacturer of private-label over-the-counter pharmaceuticals. Organizations of this type typically manage manufacturing data, supply-chain records, regulatory documentation, employee information, and commercial relationships with retailers and distributors.

A breach affecting a firm in the pharmaceutical and consumer-health sector is consequential because the company sits at the intersection of product safety, regulated manufacturing, and large-scale distribution. Even when the precise contents of taken files remain unconfirmed, the mere possibility of internal operational material leaving the organization can affect partner confidence, regulatory scrutiny, and the practical security of related business processes.

What data was at risk

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No further breakdown—such as whether the files contained employee records, customer data, manufacturing specifications, financial documents, or other categories—has been publicly disclosed. The number of people affected is listed as unknown.

Companies in Perrigo’s sector commonly hold a range of sensitive information: personnel files, supplier contracts, quality-control records, and commercial data. Because the exact contents remain unconfirmed, it is not possible to state which of those categories, if any, were involved. Readers should treat any specific data-type claims beyond “internal files” as unverified unless additional official disclosure appears.

What's at stake

For individuals whose information might later prove to have been included, the concrete risks include potential misuse of personal identifiers, targeted phishing that references internal company details, or longer-term identity-related friction. Because the scale and contents are unknown, the actual exposure for any given person cannot yet be quantified.

For the organization, the stakes center on operational disruption, possible regulatory notification obligations, and the need to assess whether manufacturing, supply-chain, or commercial data could be leveraged by third parties. Ransomware incidents of this type frequently require extended recovery work even after systems are restored, and the public listing itself can generate secondary scrutiny from partners and regulators. None of these outcomes is automatic; they depend on what was actually taken and how the company responds.

What to do if you're exposed

If you have a current or past relationship with Perrigo Company—as an employee, contractor, supplier, or other party—monitor official communications from the company for any notification that your data was involved. In the meantime, treat unsolicited messages that reference the incident with caution, enable multi-factor authentication on important accounts, and review financial and credit activity for unusual behavior. Because the number of people affected and the precise data types remain unknown, there is no confirmed list of exposed individuals at this stage.

As a practical first step, you can run a free exposure scan of your email address to check whether that address has already appeared in other known breach data sets. Doing so provides a baseline of existing exposure and helps prioritize further protective measures while waiting for any additional Reported Details about this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.