Ransomware: qilin claims Heartland Catfish (US) — Agriculture and Food Production

As a senior EU regulatory compliance analyst, I summarize the following regulatory-relevant event: On 18 July 2026, the ransomware group Qilin publicly claimed responsibility for a cyberattack against Heartland Catfish, a US-based entity in the agriculture and food production sector. This incident was published on the ransomware leak site ransomware.live under the BREACH framework. While this is a US-specific event, it signals a material threat to critical infrastructure sectors that are increasingly targeted under EU regulations such as NIS2 and the Digital Operational Resilience Act (DORA).

The primary affected organizations are those in the agriculture, food production, and broader agri-food supply chains, including processors, distributors, and logistics providers. Given the interconnected nature of EU food supply chains, any disruption to a US producer can have cascading effects on European importers, retailers, and food safety compliance. EU-based entities that rely on US suppliers or operate similar production environments should consider themselves indirectly at risk.

Compliance teams should immediately review their third-party risk management frameworks, particularly for US-based suppliers in critical sectors. Ensure incident response plans include ransomware-specific playbooks and that breach notification timelines under NIS2 (24-72 hours) are understood. Conduct a targeted risk assessment for food production assets, and verify that cyber insurance policies cover ransomware extortion. Finally, monitor ransomware.live and similar threat intelligence feeds for any data leaks that may involve EU customer or supplier information.