#industrialcontrolsystems

The Chaos ransomware group has claimed an attack on Aphena Pharma Solutions, a U.S.-based pharmaceutical contract manufacturer. The group listed the company on its dark web leak site on July 14, 2026, alleging the theft of 142 GB of 'critical corporate data,' including sensitive financial documents. The attackers claim to have gained full access to the company's infrastructure, employing a double-extortion strategy by threatening to leak the stolen information.

Security researchers from Palo Alto Networks' Unit 42, in collaboration with Siemens, have discovered a critical exploit chain of three zero-day vulnerabilities in Siemens RUGGEDCOM ROX II operational technology (OT) switches. The vulnerabilities, tracked as CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949, can be combined by an attacker to gain persistent, root-level access to the devices. The chain begins with an information disclosure flaw, progresses to privilege escalation, and concludes with establishing persistence. Given that these switches are foundational components in industrial control system (ICS) networks, a compromise could have severe consequences for critical infrastructure operations. Siemens has released firmware version V2.17.1 to address these vulnerabilities and urges customers to update immediately.

Fairlife, a dairy subsidiary of The Coca-Cola Company, has suspended all U.S. production after a ransomware attack compromised its IT and operational technology networks. The breach was detected on July 16, 2026, leading to an immediate shutdown of affected systems and the launch of an incident response investigation with external experts and law enforcement. While products currently in stores are deemed safe, the halt in production at plants across the U.S. could lead to product shortages. The identity of the threat actor and the full financial impact are not yet known.

The 'World Leaks' ransomware group has leaked 14.3 GB of files allegedly stolen from Reliance Group, a contractor for India's Kudankulam Nuclear Power Plant (KKNPP). The data, posted on the dark web, includes purported blueprints, supplier lists, and equipment reviews. Reliance Group confirmed a 'partial breach' on a server hosted by a third-party data center. While there is no evidence the plant's operational networks were breached, the incident exposes sensitive engineering data that could be used to plan future attacks against the critical infrastructure facility.

Japanese logistics giant Nichirei Corporation suffered a major cyberattack, causing significant disruption to the nation's food supply chain. The attack, detected on July 13, forced the company to halt operations at its refrigerated warehouses, impacting major clients like KFC Japan, which warned of potential store closures. The shutdown also affected retailer Aeon and restaurant operator Colowide. Nichirei, Japan's largest cold-chain operator, has since begun a phased resumption of services. The company has not disclosed the nature of the attack but confirmed some servers contained personal information.