Pepsi Bottling Ventures LLC suffered an information breach brought on by a community intrusion that resulted within the set up of information-stealing malware and the extraction of knowledge from its IT programs.

Pepsi Bottling Ventures is the biggest bottler of Pepsi-Cola drinks in america, chargeable for manufacturing, promoting, and distributing common shopper manufacturers. It operates 18 bottling amenities throughout North and South Carolina, Virginia, Maryland, and Delaware.

27-day publicity window

In a pattern safety incident discover filed with Montana’s Legal professional Normal workplace, the corporate explains that the breach occurred on December 23, 2022. But it surely wasn’t till January tenth 2023, or 18 days later that it was found, with remediation taking even longer.

“Based mostly on our preliminary investigation, an unknown social gathering accessed [our internal IT systems] on or round December 23, 2022, put in malware, and downloaded sure data contained on the accessed IT programs,” reads the discover.

“We took immediate motion to include the incident and safe our programs. Whereas we’re persevering with to observe our programs for unauthorized exercise, the final identified date of unauthorized IT system entry was January 19, 2023.”

Based mostly on the outcomes of Pepsi’s inner investigation to date, the next data has been impacted:

• Full title
• Dwelling deal with
• Monetary account data (together with passwords, PINs, and entry numbers)
• State and Federal government-issued ID numbers and driver’s license numbers
• ID playing cards
• Social Safety Numbers (SSNs)
• Passport data
• Digital signatures
• Info associated to advantages and employment (medical health insurance claims and medical historical past)

In response to this incident, the corporate has applied further community safety measures, reset all firm passwords, and knowledgeable the regulation enforcement authorities.

Right now, the overview of doubtless affected information and programs remains to be underway, whereas all affected programs have been suspended from the agency’s common operations.

The recipients of the breach notices are being supplied a one-year free-of-charge identification monitoring service by way of Kroll to assist them forestall identification theft that will happen because of the stolen knowledge.

It’s nonetheless not clear what number of people had been affected by the info breach and whether or not the affected events embody prospects or staff.

BleepingComputer has contacted Pepsi Bottling Ventures to request extra particulars in regards to the assault and the scope of the influence, and we’ll replace this submit as quickly as we hear again.