Malware: Food, Germany 2025
In May 2025, Arla confirmed suspicious activity in the local IT network of the Upahl dairy plant.
- Incident · 05.2025 · Mecklenburg-Western Pomerania (Upahl), Germany
- Evidence: confirmed by an authority
- Malware
As of
What happened
The security measures interrupted production, and customers were informed of possible delivery delays and cancellations. Other Arla sites were not affected; the company gave no details on the perpetrators or ransomware.
- Affected
- Arla Foods (Upahl plant)
- Industry
- Food
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Property damage caused by an attack
Spoiled goods, damaged machine
Mostly not covered 0 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Disconnecting the network protects the group but stops the affected plant; plant networks should be able to keep running separately.
Sources
- Arla Foods confirms cyberattack disrupts production, causes delays (opens in a new window) BleepingComputer · 2025-05
- Molkereikonzern: Offenbar Cyberattacke auf deutsches Werk von Arla (opens in a new window) Lebensmittel Zeitung · 2025-05