Stoli Group USA files for bankruptcy after ransomware attack

Stoli Group USA and Kentucky Owl, U.S.-based subsidiaries of the Luxembourg-based vodka manufacturer Stoli Group, have filed for Chapter 11 bankruptcy months after a ransomware attack disrupted their operations.

Stoli Group USA and Kentucky Owl President and CEO Chris Caldwell said in the Nov. 29 filing that the cyberattack was among several factors leading the companies to seek relief, with the August 2024 attack on Stoli Group reportedly preventing the U.S. subsidiaries from complying with their lenders’ reporting requirements.

Other factors cited included decades-long legal battles between Stoli Group and the Russian government under President Vladimir Putin after he signed an executive order claiming state ownership over the formerly Russia-based private company, as well as macroeconomic issues including inflation and decreasing demand for alcohol products after the COVID-19 pandemic. The dispute with the lenders allegedly caused them to contact Kentucky Owl’s vendors to order a halt of any sale or transportation of existing inventory.  

The companies ultimately accumulated about $84 million in debt as a result of these factors, according to Caldwell. Prior to Caldwell’s filing, the ransomware attack against Stoli Group was not widely reported and has not been claimed by or attributed to any specific ransomware group.

Caldwell described the incident in August as a “data breach and ransomware attack” that impacted the operations of all of the companies within the international Stoli Group, including the disabling of the group’s enterprise resource planning (ERP) system. Since the attack, most internal processes, including accounting functions, have been performed manually, with systems not expected to be fully restored until at least Q1 2025, Caldwell wrote.

Financial impact of cyberattacks increasing

Research has revealed that the average costs of responding to and recovering from a ransomware attack have increased over the past year, with Sophos’ State of Ransomware 2024 report citing an approximate 50% increase in average recovery costs from $1.82 million in 2023 to $2.73 million in 2024, excluding any ransom payments. The report also showed that 84% of private companies also lose revenue due to lost business opportunities resulting from the attack, further expanding the financial consequences of ransomware.

Data breaches, whether related to ransomware or not, have also seen an overall 10% increase in average cost, with the total average total cost of dealing with a breach hitting $4.88 million in 2024, according to IBM’s Cost of a Data Breach 2024 report.

Stoli Group USA and Kentucky Owl are not the first companies to file for bankruptcy related to a cyberattack this year. Jerico Pictures, doing business as National Public Data, filed for Chapter 11 bankruptcy in October following a massive breach that exposed nearly 899 million Social Security numbers. The data broker cited reputational damage, numerous class action lawsuits, potential state and federal fines and more in its filing.

Nursing home operator Petersen Health Care also filed for Chapter 11 relief in March in the aftermath of the two ransomware attacks: an attack on the company itself in October 2023 and the Change Healthcare supply chain attack in February 2024, which affected Petersen’s systems, Reuters reported. The healthcare organization said the cyberattacks contributed to missed payments on $45 million in loans insured by the U.S. Department of Housing and Urban Development (HUD), with the company’s total debts totaling more than $295 million.

The existential threat of major cyberattacks is not limited to the United States. Australian digital prescription company MediSecure Limited went under the control of an administrator and its subsidiary Operations MDS Pty Ltd was liquidated just three weeks after a May 2024 ransomware attack led to patient information being leaked on the dark web.