The IT Nerd

Optima Tax Relief was hit by a ransomware attack by Chaos group threat actors who are now leaking 69 GB of data stolen from the company. Bleeping Computer has details:

Today, the Chaos ransomware gang added Optima Tax Relief to its data leak site, claiming to have stolen 69 GB of data. 

This data contains what appears to be corporate data and customer case files. Tax documents commonly contain sensitive personal information, such as Social Security numbers, phone numbers, and home addresses, which can be used for malicious activity by other threat actors or identity theft.

Sources with knowledge of the attack told BleepingComputer that this was a double-extortion attack, with the threat actors not only stealing data from the company but also encrypting servers.

Ensar Seker, CISO at SOCRadar:

“The Optima Tax Relief breach underscores the growing interest of ransomware groups like Chaos in targeting high-trust financial service providers that handle sensitive personal data. This isn’t just a business disruption issue, it’s a national identity risk.

Tax resolution firms like Optima are rich targets because they aggregate the full spectrum of personally identifiable information (PII): Social Security numbers, tax documents, financial disclosures, and often even power-of-attorney authorization records. When exfiltrated, this data doesn’t just enable identity theft, it fuels secondary fraud operations for years.

“The fact that this was a double-extortion attack, involving both encryption and data theft, is unfortunately now the standard playbook. What’s more concerning is that Chaos ransomware has only recently emerged, yet already demonstrates the operational maturity of a seasoned group. Their ability to launch effective attacks and publicize breaches so quickly suggests they’re leveraging pre-existing access-as-a-service networks or recycled stealer logs for rapid compromise.

“From a defender’s standpoint, this is a call to action: Organizations that handle financial or tax data need to treat endpoint telemetry, privileged access management, and data exfiltration detection as minimum baselines. And more broadly, this reinforces the importance of having not only an incident response plan but a breach communications plan tailored for sensitive customer-impact scenarios.”

Erich Kron, Security Awareness Advocate at KnowBe4:

“The Chaos ransomware group is fairly new on the scene but has claimed a few victims already. This victim is an interesting one due to the significant amount and types of data that were collected and likely stolen. The customers will have provided not only Social Security numbers and other personal information, but also a lot of personal and sensitive financial information that may be embarrassing and that they may not want to be made public. The type of information stolen could also be used by social engineers to convince victims that they are from Optima and may lead to future scams and financial losses.

“The specific attack vector has not been released, but generally speaking, ransomware is most often spread through attacks on the humans within organizations, such as email phishing, vishing, or smishing. For this reason it is very important for organizations to have a robust and well-planned human risk management (HRM) program in place.”

This is an attack that will not end well. Not for Optima, and not for their customers. Expect this hack to reverberate for months or longer.

United Natural Foods (UNFI), North America’s largest publicly traded wholesale distributor, was forced to shut down some systems following a recent cyberattack. The Rhode Island-based company operates 53 distribution centers and delivers fresh and frozen products to over 30,000 locations across the United States and Canada:

On June 5, 2025, United Natural Foods, Inc. (the “Company”) became aware of unauthorized activity on certain of its Information Technology (IT) systems. The Company promptly activated its incident response plan and implemented containment measures, including proactively taking certain systems offline, which has temporarily impacted the Company’s ability to fulfill and distribute customer orders. The incident has caused, and is expected to continue to cause, temporary disruptions to the Company’s business operations. The Company is working actively to assess, mitigate, and remediate the incident with the assistance of third-party cybersecurity professionals and has notified law enforcement. Pursuant to its business continuity plans, the Company has implemented workarounds for certain operations in order to continue servicing its customers where possible. The Company is continuing to work to restore its systems to safely bring them back online.

The investigation to assess the impact and scope of the incident remains ongoing and is in its early stages.

Erich Kron, Security Awareness Advocate at KnowBe4: 

“Operations such as this often work on a very tight timeline, so the pressure can be high to get systems up and running as soon as possible. This is what attackers hope for as they dangle the idea in front of the victims that paying the ransom will get organizations back online quickly. While decrypting the data could possibly restore operations more quickly, there is a huge danger that back doors are left in place to be exploited again, or that after payment, encrypted files turn out to be corrupted and unrecoverable.”

“Not only do attacks such as these really put the pressure on the victim, but the organizations that rely on the products are also put in a spot as well. If the wholesaler can’t get items to the retailer, the retailer suffers greatly as well and might look for other options to make future purchases, costing the wholesaler customers and their reputation.”

“Since the vast majority of ransomware attacks are started by exploiting employees, organizations should have a robust human risk management program in place to address threats such as social engineering, poor credential hygiene, and other human-centric threats.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“Although UNFI hasn’t stated as much, this attack has all the hallmarks of ransomware. Ransomware attacks can lock down computer systems, forcing companies to pay a ransom or face extended downtime and permanent data loss. These attacks can cripple companies and even force them to shut down permanently in some cases, so they should not be taken lightly. This attack could have knock-on effects including higher food prices for consumers.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy:

“Cyberattacks like the one UNFI has been hit with can cause delays in deliveries, product shortages, and even store closings and temporary layoffs, due to organizations’ reliance on computer systems. While we don’t know exactly what type of attack has been launched against UNFI or how it was launched, it does emphasize how companies need to ensure that their internal systems, as well as those of their suppliers and partners, are kept up to date to plug security holes.”

I for one would would like to see more details disclosed. As in what happened, what the downstream effects are, and what UNFI will do to ensure that it doesn’t happen again. Because that will enable it’s business partners and the public to trust them going forward.