mythsthe wider recordStoli Group2024beverages and manufacturing

everyone assumed:

a ransomware hit is recoverable; it won't threaten survival

what was actually true:

Ransomware is often recoverable, and whether it is depends on which system it lands on and what that system was holding up.

how it happened

  1. whoransomwareAugust 2024
  2. the gapone central systemeverything ran through it
  3. the resultlenders called defaultChapter 11 in November
the gap that let it happen the result

what everyone assumed

Ransomware is widely understood as something you survive. You restore from backups, you absorb the cost, you write the post-incident report, and the business continues. The reasonable belief is that an attack is an expensive interruption rather than an existential one, because companies recover from these events all the time. That belief holds right up until the disruption lands on a system the rest of the business cannot operate without.

what happened

The attack disabled Stoli’s enterprise resource planning system, the central record that most internal processes run through. Accounting fell back to manual entry. The work could still be done by hand, the way it once always was, but slower and without the single source of truth the company relied on. The harder consequence was not internal. With the ERP down, the group could not readily produce the financial data its lenders required, and the lenders deemed the relevant entities to be in default. A technical outage had quietly become a financial one. The company said its systems were not expected to be restored before the first quarter of 2025.

step by step

  1. August 2024ransomware disables the ERPAccounting goes back to manual entry.
  2. lenders cannot get the financial dataThey declare a default.the assumption breaks here
  3. restoration not expected before 2025
  4. 27 November 2024Chapter 11 filingThe attack is cited as a contributing factor.

how it surfaced

On 27 November 2024, Stoli Group USA and its Kentucky Owl subsidiary filed for Chapter 11 bankruptcy protection. In court filings, the chief executive cited the August ransomware attack, alongside the company’s existing financial and legal pressures, as a contributing factor in the filing. The assumption that a ransomware hit is always recoverable did not survive the moment the outage stopped being about systems and started being about whether the lenders would wait.

Ransomware is often recoverable, and whether it is depends on which system it lands on and what that system was holding up.

When the affected record is the one your financing depends on, the outage stops being a technical event and becomes a question about the survival of the business.

picture it at a company like yours

The company here is made up. The other two paths are not: they happened, and each links to the story.

your company
a normal dayYour accounting and planning system runs the business and feeds your lenders' reports.
the gap nobody seesNobody planned for it being down for months.one system with no plan B
  1. in this story
    the day it mattersRansomware disables it and the reports your lenders expect cannot be produced.
    what it costs youA technical outage becomes a financial crisis when lenders call a default.
  2. or it goes like this
    howYour main software vendor is hit and goes dark for two weeks.
    what leavessales, orders and invoicingwho ends up with itcompetitors, as customers go elsewhere
    it happenedCDK Global, 2024
  3. or it goes like this
    howBackups live where the attacker can delete them too.
    what leaveseverything, with nothing left to restorewho ends up with itthe business itself, which closes
    it happenedCode Spaces, 2014

sources

  1. Vodka maker Stoli says August ransomware attack contributed to bankruptcy filing ,
  2. Vodka maker Stoli files for bankruptcy in US after ransomware attack ,
  3. Stoli Group USA files for bankruptcy after ransomware attack ,
  4. Vodka Giant Stoli Files for Bankruptcy After Ransomware Attack ,

← all myths

your turn

what you can do about it

  1. this week

    Identify it, confirm how its access is protected, and ask how long you could go without it before a relationship outside the company started to change.

    Look at the one system that, if it went dark, would stop you from showing someone the numbers: a lender, an auditor, an insurer, a board. That system carries trust as well as operations, and an outage there spends a kind of credit you cannot quickly rebuild. The Stoli story is about what happens when the answer turns out to be shorter than anyone planned for.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.