Vodka Giant Stoli Files for Bankruptcy After Ransomware Attack

A storied Russian vodka maker has filed for bankruptcy in the US just months after it was breached by ransomware actors.

Stoli Group USA and Kentucky Owl (KO) CEO, Chris Caldwell, revealed in a legal filing that the group is around $78 million debt.

Among the contributing factors listed is a serious ransomware attack in August 2024 which caused “severe disruption” to the firm’s IT infrastructure.

“The attack caused substantial operational issues throughout all companies within the Stoli Group, including Stoli USA and KO, due to the Stoli Group’s enterprise resource planning (ERP) system being disabled and most of the Stoli Group’s internal processes (including accounting functions) being forced into a manual entry mode. These systems will be fully restored no earlier than in the first quarter of 2025,” read the court documents.

Read more on ransomware: Pro-Russian Hacktivists Launch Branded Ransomware Operations

The news is another reminder of the potentially existential threat to businesses of ransomware. On a much smaller scale, a UK logistics firm entered administration in September 2023 after a serious ransomware breach, resulting in the loss of over 700 jobs.

In Stoli Group’s case, the ransomware attack didn’t just have an immediate operational cost – it also meant the firm was unable to provide key financial reports to its lenders, contributing to its current woes.

The firm was also hit by retaliation from the Putin regime for its support for Ukraine following Russia’s invasion. Founder Yuri Shefler and the group’s two main holding companies were labelled “extremists” and two of its distilleries in Russia valued at $100m were confiscated by the government, according to the filing.

Stoli Group said it has also been forced to spend “dozens of millions of dollars” in a 20+ year court battle with the Russian authorities to defend its Stolichnaya and Moskovskaya vodka trademarks from the Russian state enterprise FKP Sojuzplodoimport.

It’s unclear whether the ransomware attack was authorized by the Kremlin, but the authorities in Russia are understood to turn a blind eye to attacks targeting perceived enemies of the regime.

Image credit: Oleg Kozlovskyy / Shutterstock.com