US meals big WK Kellogg Co is warning workers and distributors that firm knowledge was stolen throughout the 2024 Cleo knowledge theft assaults.
Cleo software program is a managed file switch utility that was focused by the Clop ransomware gang en masse on the finish of final 12 months. This assault leveraged two zero-day flaws tracked as CVE-2024-50623 and CVE-2024-55956, permitting the risk actors to breach servers and steal knowledge.
“WK Kellogg discovered on February 27, 2025, {that a} safety incident could have occurred involving Cleo,” reads the discover.
“WK Kellogg instantly started to research. We contacted Cleo, and Cleo knowledgeable us that an unauthorized particular person gained entry on December 7, 2024, to the servers Cleo hosted for us that have been used for transferring worker information to our human sources service distributors.”
WK Kellogg Co is an American meals manufacturing big cut up from Kellogg’s in October 2023. It has an annual income of $2.7 billion and owns in style cereal manufacturers corresponding to All-Bran, Corn Flakes, Froot Loops, and Frosted Flakes.
Though the corporate doesn’t particularly point out Clop or the info theft assaults, the date of the reported incidents coincides with the wave of assaults that occurred in December 2024.
Moreover, the breach notifications come quickly after the Clop ransomware gang listed WK Kellogg on their knowledge leak extortion web site.
The information breach notification shared with the authorities says the uncovered knowledge consists of an individual’s identify and social safety quantity.
The letter encloses directions on how recipients can enroll in a free one-year identification monitoring and fraud safety companies by means of Kroll. Impacted people are additionally advisable to contemplate putting fraud alerts or a safety freeze on their credit score file.
Kellogg says it labored intently with Cleo to determine the safety measures it carried out to deal with final 12 months’s breach and stop comparable incidents from occurring sooner or later.
Kellogg is the newest sufferer of a lengthy listing of firms impacted by Clop’s Cleo zero-day assaults, with the risk actors steadily disclosing further victims and stolen knowledge samples a number of months after the incident.
The earlier disclosure got here on March 18 by Arizona-based Western Alliance Financial institution, which knowledgeable 22,000 prospects their private knowledge had been stolen in an October 2024 breach of Cleo’s safe file switch software program.
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and the way to defend in opposition to them.
