Stoli Group (USA), LLC
Stoli Group (USA) ransomware incident
Summary
An August 2024 ransomware attack disabled Stoli Group’s enterprise resource planning system and forced manual accounting at its U.S. businesses. Court-filed reports later described continuing manual reporting constraints.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
U.S. businesses affected by a group-wide attack
A ransomware attack disrupted Stoli Group’s IT infrastructure in August 2024, including the operations of Stoli Group (USA), LLC and Kentucky Owl, LLC, according to a declaration by CEO Chris Caldwell filed Nov. 29, 2024.
Caldwell said the group’s enterprise resource planning system was disabled and accounting processes required manual entry. He forecast that systems would not be fully restored before the first quarter of 2025. That forecast was not a verified restoration date.
Manual reporting continued
An operating report filed Nov. 20, 2025, covering October 2025, described financial data prepared using manual reporting and entry processes introduced after the attack. The report said those constraints limited the precision of its figures.
This documents continuing accounting and reporting effects. It does not establish that every affected system remained offline throughout that period.
Bankruptcy had several contributing causes
Stoli USA and Kentucky Owl filed for Chapter 11 protection Nov. 27, 2024. Caldwell identified cyber disruption and related lender-reporting problems among several pressures, alongside softer spirits demand, higher costs and a lender dispute.
The bankruptcy liabilities are not a measure of cyberattack losses or ransom payments. The attack’s total cost and an exact date when all effects ended remain unverified.
Scope and attribution
The court declaration identifies effects on both U.S. businesses. Their shared executive office was in New York; the bankruptcy court’s Texas location does not establish an affected Texas office.
A June 25, 2025, disclosure statement, filed by the two U.S. businesses, says affected servers were in Latvia. It reports that authorities investigating there found data encryption without theft. The underlying investigative report was not reviewed, and this account does not independently establish who carried out the attack. The filing describes the Latvian criminal case as continuing at that time.
No reviewed source establishes a named attacker, a ransom payment or a personal-information victim count. The filing’s political and legal background does not independently identify the attacker.
Subsequent company update
In a Jan. 15, 2026, company release, Stoli said cyberattack remediation continued. It also announced that the two U.S. businesses had sought conversion to Chapter 7 liquidation after failing to agree on a reorganization with their lender. The release described a motion and future trustee control; it did not establish the date of a court conversion order.
Ongoing remediation does not establish a continuing service outage at both U.S. businesses. The release also said the wider group’s operations continued, so its description cannot be treated as a group-wide shutdown.
Current assessment
The incident is presumed resolved because the last verified operational effects are documented for October 2025, more than 30 days before this review. The January 2026 reference to continuing remediation supplies no later dated service failure. No reviewed source establishes an exact end date or a full restoration date for both U.S. companies.
Organizations involved
Kentucky Owl, LLC
Location
Organization type
Critical infrastructure
Impacted location
New York City, New York
The affected U.S. debtors shared their principal business office at 135 E. 57th St., ninth floor, New York. The CEO declaration establishes disrupted administrative and accounting operations. This is an organizational office-city relationship, not proof that compromised servers were physically at this address. No citywide outage or affected Texas court site is inferred.
Sources
DysruptionHub reported that a cyberattack disrupted the Stoli U.S. business, required manual operations and was among the pressures surrounding bankruptcy.
The debtors described an August 2024 ransomware attack and data breach that disabled group enterprise resource planning systems, forced manual accounting and impaired lender reporting. They identified cyber disruption among multiple pressures preceding their Nov. 27 Chapter 11 filings.
The businesses reported that the affected servers were in Latvia and that investigators there found encryption without theft. They described continuing operational problems and a continuing Latvian criminal investigation.
The October 2025 financial statements said that manual reporting and data-entry processes introduced after the August 2024 cyberattack continued to constrain preparation of the financial data.
The company said remediation was continuing and that its two U.S. businesses had filed a motion to convert their Chapter11 cases to Chapter7. It described the wider group’s continuing operations.
See something that needs correction?
Signed-in members can report an error, update, or missing source.