A ransomware attack at Evergreen Printing Company in Bellmawr, New Jersey, disrupted newspaper printing and subscriber fulfillment in December 2025. A customer publication reported problems with press operations, mailing lists and company communications as Evergreen investigated and restored systems.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
DysruptionHub assesses with high confidence that Evergreen Printing Company experienced a malicious cyber incident in December 2025. Our reporting drew on the affected customer newspaper The Retrospect, which identified ransomware and said Evergreen’s systems were locked up around Dec. 19. A later Kaspersky ICS CERT review also listed the printer’s December disruption as ransomware. Kaspersky’s table names Qilin, but the reviewed material does not include a verifiable actor post or independent proof of that attribution.
The disruption affected press operations, subscriber mail lists and company communications. The Retrospect warned that subscribers might see delivery errors while staff rebuilt mailing lists. The incident therefore affected both Evergreen’s production and at least one downstream newspaper customer; the record does not establish effects at every customer.
An Evergreen representative told The Retrospect that the company activated its incident-response plan and engaged outside experts. No reviewed source establishes an exact restoration date or a final account of the affected systems. Because the last documented operational impact was in December 2025, this retrospective record is presumed resolved, without claiming a confirmed all-clear.
The local customer’s first-hand account and Evergreen’s response statement support high confidence in a cyber incident and material disruption. Ransomware is supported by the customer report and later industry review, but public details of encryption, a ransom demand and any payment are limited. Evergreen said it was not aware of evidence confirming that personal data had been accessed or removed; that preliminary statement is not a final forensic finding.
The initial access method, malware variant, actor identity, full customer impact, final restoration date and data-exposure outcome remain unresolved.
Qilin’s victim listing named Evergreen Printing, and Kaspersky ICS CERT later associated Qilin with the December 2025 printer disruption. The indexed listing uses egpp.biz while the Bellmawr, New Jersey printer identifies egpp.com as its website. The group claim and its identity match have not been independently confirmed; this record does not establish Qilin’s role, data theft or a link to the operational outage.
Evergreen's Bellmawr printing facility is the physical place anchor.
We reported that The Retrospect identified a ransomware attack at Evergreen Printing around Dec. 19, 2025, and described disrupted printing, subscriber fulfillment and company communications. Evergreen said it activated incident response and was investigating.
The Q4 2025 industrial cybersecurity review lists Evergreen Printing as a U.S. printer affected by denial of IT systems and services and ransomware in December 2025, and names Qilin without supplying a verifiable actor post in the reviewed table.
Signed-in members can report an error, update, or missing source.
