Access the full text logs of this transmission for compliance and review purposes.
00:00:01:06 – 00:00:07:19
Actual
Welcome to Status Secure, the weekly Cyberthreat briefing for executives who refuse to operate in the blind.
00:00:07:21 – 00:00:20:08
Actual
Hosted by the watcher six collective, uniting former Army Special Forces and Naval Special Warfare communications operators alongside an industry leading CISO nominated for cybersecurity. Woman of the world.
00:00:20:10 – 00:00:27:05
Actual
We cut through the noise and give you the operational intelligence you need for mission success in a hostile digital environment.
00:00:27:07 – 00:00:28:10
Actual
The enemy is listening.
00:00:28:13 – 00:00:32:02
Actual
Is your status secure?
00:00:32:04 – 00:00:52:17
Actual
Welcome to Data Secure. Today we’re covering three of the biggest cyber events of 2026 so far. And what connects them. The ransomware attack that shut down Coca-Cola’s fair live production lines in July. The 1.4TB of Nike’s internal documents that showed up on a leak site in January. And then we’re going to get into the match group breach because it is one of fun.
00:00:52:17 – 00:01:03:02
Actual
That should worry technology companies. So seaso start with Coca-Cola. A ransomware event physically stopped milk production at four plants. Walk us through what happened.
00:01:03:03 – 00:01:34:15
CISO
Yeah. So this was, you know, this was not a records breach, right? It actually stopped manufacturing. So on July 16 of this year. So just recently, the Coca-Cola company announced that, you know, for life, you know, and their dairy. Right. So if you drink for your life, you know, it’s dairy subsidy. They had identified that there was unauthorized access by, you know, pipe by someone that was not you know, that of a valid person.
00:01:34:15 – 00:02:05:12
CISO
Right. So, so that third party had access to a portion of their systems. This included their production related systems. And so and it had to do with ransomware. Right. So they put out. So think about that. Right. Because Coca-Cola you know they’re all their manufacturing basically. Right. The manufacturers so they rely on machines now to do I don’t know if you’ve ever worked in manufacturing, but it’s like just assembly lines, right.
00:02:05:14 – 00:02:34:07
CISO
Assembly lines with like control systems. These are like control systems that just run the manufacturing lines. Right? There’s like you remember in Laverne and Shirley, now I’m gonna go back in time, but no. Oh my gosh. Okay, for those of you who never watch Laverne and Shirley look it up. Okay. It’s these two. It’s these two women in Milwaukee, and they worked, you know, in a manufacturing plant.
00:02:34:08 – 00:02:56:20
CISO
And so. Yeah. And so in the beginning credits, you see just autos, you know, like autos go by, right? And that’s what it looks like. So, you know, it’s just it’s just machines with like, you know, what happens is, you know, these bottles will go by, you know, it’ll drop the bottles, then it’ll pour in the milk, and then it will, seal the cap.
00:02:56:20 – 00:03:14:21
CISO
Right. And this is all this is. This is all. And used to be. It used to be a long time ago. People would sit there and put the bottles on the assembly line, and then somebody, you know, somebody would pour the milk in and then somebody would. And that’s that would be their job all day. And then somebody would, you know, put the cap on.
00:03:14:22 – 00:03:41:21
CISO
Right. Well, it’s not people anymore. People monitor the the machines and the machines are running the assembly lines. Okay. So so they had ransomware that affected their their control systems, right. For their manufacturing. So U.S. production operations were, you know, were suspended because of the ransomware. Canadian operations weren’t impacted, but product quality and safety were not impacted. Right.
00:03:41:21 – 00:04:12:14
CISO
But the actual production was. And so the Anubis ransomware group, they they put on their site that they had July 20, they claim that one terabyte of stolen like they had stolen data and was told BleepingComputer it had encrypted the companies Nutanix Systems and Coco code did not negotiate. On July 27th, 2026, the company confirmed data was taken and said the majority of production had resumed across its four U.S. facilities.
00:04:12:17 – 00:04:34:13
CISO
You know, so, you know, why does this matter? Think about that. So they identified them July 16th. They had the ransomware and they didn’t pay. Why? They had to make that decision. Now they had to make sure that they could get those systems back up. And then, you know, they had to do the investigation. And then, you know, how much, how much you have to calculate.
00:04:34:13 – 00:04:55:22
CISO
One of the things that it’s hard, but you have to be able to calculate, right. So that way you can make the decision. So once once production stopped you know, how much money did that cost? You know Coca-Cola and fair life, right. And then how much ransomware did they want. Right. What was what was the ransom demand? And then based on that, you have to make a decision.
00:04:55:23 – 00:05:15:20
CISO
The executive has to make a decision. Right. Do we pay? Do we not pay? Right. Do we think. Do we think like, you know, we can get our systems back up and running right and be confident that they’re not going to be they’re not going to get affected again. So those are a lot of the things that you have to you have to do it beforehand.
00:05:15:22 – 00:05:37:16
CISO
So hopefully they did their you know they run exercises before on this. And I think that’s why they felt confident right that they didn’t have to pay. They can get their systems back up and running. The good thing is you know, it sounds like they probably had a isolated network, right. So their production, it says their production in the US was affected, but their production in Canada wasn’t.
00:05:37:18 – 00:06:02:19
CISO
Because imagine if, if, if they had if all of their networks were connected. Okay. And, and this, you know, this that actually knew this was able to infect all of their manufacturing. Right. It would have been a lot worse. Right. And it was based on an account. Again, same thing. We’ve talked about this before and managing you know, managing access and identity controls.
00:06:02:21 – 00:06:27:02
Actual
Got it. Yeah. And some facts around that. You know, the Verizon 2026 data breach investigation report found that ransomware was present in 48% of breaches, and that 69% of ransomware victims did not pay. Also for the Coca-Cola event. And they said that their shares fell roughly 4% the day after they disclosed what happened. So you know, who knows why or what happens.
00:06:27:02 – 00:06:41:20
Actual
But there are certain facts to to, you know, to know about and so kind of segue into Nike, which is maybe opposite in some ways. No encryption, no production stoppage. And as far as anyone can tell. Not one customer record. So walk us through what what happened with Nike.
00:06:42:01 – 00:07:02:18
CISO
So for Nike on January 26th. 20. So early really early this year, a group called World Bakes publish approximately 1.4TB. When you see I mean, all of these are not like, you know, a couple of thousand records. They’re taking terabytes of data at a time now. So that means they’ve been in there for a while, like they’ve been doing.
00:07:02:18 – 00:07:30:23
CISO
They’re like, yeah, know, kind of like they’re collecting, you know, just hanging out, collecting information, trying to find like they’re critical as the most valuable and critical assets. And so, you know, so Nike had you know, so so they published that one like so here’s a thing. What they published that Nike was investigating and said no customer employee personal data was found in the leaked data set.
00:07:31:01 – 00:08:00:18
CISO
Okay. Think about that. You know, there’s a couple of things going on here. Number one, you know, this this group said they that they that they had exfiltrated, you know, 1.4TB of data from Nike okay. Nike investigate and said no employee or customer data was found in the data. What did they steal then? If there was no employee, you know, if there was no employee or customer data, you’re telling me a group got in, they, you know, and they they left with what?
00:08:00:20 – 00:08:26:19
CISO
Like just public documents that they could get on, you know, on the company’s, you know, externally facing website. That’s a little suspicious, I would say. That’s my thoughts on that. Right. But hey you know Nike Nike said that nothing. No. Not in the. No. No personally identifiable information was taken. The material. They, you know, said reportedly product design.
00:08:26:19 – 00:08:51:02
CISO
So this is what they said it was not customer employee personal data, but they had taken product designs, manufacturing workflows, pricing audit results, partner data, production plans, supplier information. And you know, again you know I, I am a very suspicious mind. I feel like that was that was Nike’s I Chinese you know with that with with that messaging okay.
00:08:51:03 – 00:09:21:15
CISO
But but hey I’ll leave it to Nike and their and their attorneys okay. But but what makes updates on extraction and extortion rather than encryption. Right. There is nothing to restore from back up. Right. Because nothing was locked. So think about that. They got in, so they got in. They didn’t encrypt. So they’re not doing ransomware. They just, you know, did reconnaissance found things that they thought were going to be, you know, worthwhile to take and then took them.
00:09:21:21 – 00:09:42:08
CISO
So it’s like, yeah, it’s like somebody came to your house, walked around your house looking for, you know, valuables. Right. And then and then they just took them. They they didn’t break anything in your house. They didn’t, you know, they didn’t put locks on anything valuable like you’re safe. They just they just took it. Okay. So? So what?
00:09:42:13 – 00:10:02:09
CISO
So why would they do that? Right. If they’re not going to ransomware it. Right. But there’s nothing to restore from backup because nothing was lost. So the backup strategy doesn’t matter at this point, right? And I don’t know if people actually test for this for this case. But now it’s like, what do you do? Your data is gone.
00:10:02:11 – 00:10:26:09
CISO
Okay. And from what they say, they took, you know what? Why do you think they took it? What do you think they’re going to do with it? I mean, this is Nike, right? So, you know, so they’re looking at like competition by giving those things or selling them to the competitors using those designs. Right. There’s those like those designs, those sneaker designs to counterfeit them and sell them.
00:10:26:09 – 00:10:48:22
CISO
Right. So you know, so so you know, how does that impact Nike. Right. They have to actually they need to look at stuff like that. I mean they should already. Right. Because that’s but again so that is number one it’s reputation in the other. And the only one with their like you said the stock went down. So this this kind of event number one it’s their reputation.
00:10:48:22 – 00:11:14:20
CISO
It’s you just heard what I, I was like okay well I’m not sure what if they’re actually honest now I don’t know. You know what. You know what I mean. So now it’s like their reputation is damaged by that could impact, you know, the value way. And then, you know, and then now if they flooded, you know, like like if do you remember, I don’t know if you remember when people used to it like, like the latest Nike that came out.
00:11:14:21 – 00:11:39:14
CISO
It’s like hundreds of dollars, right. Because you couldn’t get them. I don’t know if you remember that. I don’t know if that’s still the case, but I’m sure it is, because there’s some people who’d pay a lot to be to have the like the, the newest Nike that comes out and they do limited edition. And what happens if you if, if that limited edition you can just, you know, go get it online on some website.
00:11:39:16 – 00:11:59:18
CISO
Right. Yeah. So so that’s where the impact really is for, for that you know for that one. But you know again. Yeah. Where where did this you know, where did the tap how did this happen. Right. And it was a third party partner system and supply chain. I mean, they they haven’t confirmed it, but that’s what they’re suspecting it is.
00:11:59:18 – 00:12:22:21
CISO
And we’ve talked about this to your third party. You know, your supply chain. If you don’t know what your supply chain is doing, you know, you know, they they’re the they’re an easy way because maybe they say, okay, Nike’s big they can secure their systems. But what about you know, their, their supply chain. Is there a third party that Nike relies on that’s small, that doesn’t have the ability to secure their systems as well?
00:12:23:00 – 00:12:48:00
CISO
Is there a way in right through that? Okay. So, you know, IBM puts the average time to identify and contain a breach at 241 days. That’s almost a year. Right. So think about that. You know, because they moved 1.4TB out of the network. You know, that’s you know, that took a little bit of time, right. But they were in there for almost a year.
00:12:48:02 – 00:13:05:15
Actual
And well, you know and and something I want to touch on you brought up is like the why and the counterfeit, you know, shoes for example. Because this is a conversation I had with my son. This is maybe a couple of years ago. He was really into, like, the Jordans or whatever, all the other stuff. Right? All like this.
00:13:05:15 – 00:13:24:02
Actual
The new, the custom stuff, like the unique stuff. The really expensive stuff. And, you know, he he’s in high school, he doesn’t have, 4 to $600 to drop on a new pair of shoes every couple of months. Right. And so he would be like, this is really cool, but I’m going to go online and buy the knockoff version because honestly, nobody can tell.
00:13:24:03 – 00:13:42:19
Actual
No one can tell. I’ll get them. I’ll wear them. They’ll match my outfit. It’ll look super cool. All my friends will think it’s super cool and I only paid like whatever, 60 bucks as opposed to $400. You know, that’s a market out there. And when we would talk about these conversations with this generation, from what I’ve heard from them, they don’t really care like my generation cared.
00:13:42:23 – 00:13:59:03
Actual
They’re like, no, no, no, this has to be like the, the, the name brand. Like the real stuff. Nobody’s going to wear knockoffs. We don’t do that. His generation, though, are knockoffs all day long. They don’t care. And it’s just interesting. So I can see why this seems like it’s not a like, what did you take? But I can I can see it.
00:13:59:04 – 00:14:19:21
Actual
It’s like, no, this is where people are buying stuff. They want that new Nike shoe, but they want to pay 60 bucks for it, and they’re not going to pay the $400 for the night. The average person. Right? So yeah, I totally can can see like why this happened. And you know, so before we move on to the next topic, you know, we discussed a couple things in these incidents that happened already this year.
00:14:19:22 – 00:14:28:10
Actual
Could you give us a couple a couple, marching orders and things that someone listening can take away from this and they put into action this week. So this kind of stuff doesn’t happen to them.
00:14:28:12 – 00:14:53:20
CISO
Yeah. The first is, you know, is identify. You know, you’re you’re you know what’s really critical. Your crown jewels. Right. And check whether or not you secured that. I can tell you most companies you know you know most companies like what they do is they base it on what regulators or auditors like data protection. And you hear that all the time in security, data protection, data protection like what?
00:14:54:01 – 00:15:26:05
CISO
You know what’s critical. What’s what’s critical data right. What’s critical assets. And they tie it to you know we talked about health care. They tie it to most other companies tie it to like PII. Right. Personally identifiable information or your financials like like you know your your books. Right. Like how much money revenue revenue like how much money you’re making and other I access to like credentials for for you know for your accounts right.
00:15:26:07 – 00:15:49:20
CISO
So things like that. But in you know in fair lives you know situation it’s not you know it’s not that that wasn’t what’s critical for fair life because they are manufacturing. Hey there. What’s critical for them is uptime, right. Because they’ve they’re manufacturing. And so you know, take a look at your security program. What do you what do you securing.
00:15:50:01 – 00:16:14:10
CISO
Make sure that aligns with actual like business objectives. And you know and what’s really like your critical services. Right. For the for the business. Right. Not just you know the real you know what what what an auditor or a regulator says it’s critical to make sure you do that. The other thing is, you know, everybody’s always testing ransomware.
00:16:14:10 – 00:16:34:02
CISO
I know like that. Like everybody’s always testing ransomware, right? Like what happens when, you know, they encrypt our files and now we’ve got to restore from back up. Right. Like everybody test that. That’s why you do like disaster recovery plans. Right. And that’s why you do, you know, disaster recovery. You know, drills and testing. But you make sure you’re testing.
00:16:34:02 – 00:16:55:02
CISO
What if they what if they don’t encrypt and they just take all your data. Are you critical? You know, data. What do you do? Your data is out there. Hey, you know what? Now? Hey. And not that, you know, you’ve got your reputational risk there. Like, how do you how do you make sure that you can quickly address that?
00:16:55:02 – 00:17:14:22
CISO
You know, the public’s concern is this is this a company I want to, you know, I want to buy, I think time or invest in or right. Like how do you how do you address that? Make sure you’re looking at that as well. Not just, you know, like being able to recover in and and a ransomware situation. And then what’s your process.
00:17:14:22 – 00:17:43:18
CISO
Right. So here’s one here’s a question. You know, that every every company should say, because a lot of regulations tell you that disclosure is based on materiality okay. You need to disclose when the when the event. Right. When the incident is material. Why? What does that mean? You know who wrote you know who wrote that? A lawyer wrote that okay.
00:17:43:18 – 00:18:06:00
CISO
So I’m going to tell you I want to tell you this. If you don’t if you don’t define materiality, the regulator will. The other attorney. Well, okay. And if it doesn’t match what you believe materiality is, you’re going to be fined a lot more. But if you come when the regulators come, you say, hey, this is we we did all of our research.
00:18:06:00 – 00:18:41:23
CISO
We talked to folks, you know, in the industry. We talked to someone at, you know, this agency and based on all of that, we believed materiality. You know, it was defined like at this. And because we didn’t reach this, that’s why we didn’t notify. Okay. So you have to be able to support that okay. So, you know, make sure you know what your, what materiality and your disclosure process are like like Coca-Cola filed under item 8.01 and and stated it had not yet determined mature impact and a defensible judgment made in days.
00:18:42:01 – 00:18:54:13
CISO
If you are public are heading there. That decision actually gets written now, not during the incident. You have to know because you have to be able to defend whatever decisions you make.
00:18:54:15 – 00:19:14:15
Actual
Yeah. And I think, you know, kind of where we’re at to take a step back for this episode where we’re out on time. I think what we’ll do is we’ll make this a two part episode, and we’ll get into the match Group breach on the next one. And so for now, I think we’ve covered, you know, some, some interesting talking points, some things that did happen, you know, things to stay aware of.
00:19:14:15 – 00:19:29:06
Actual
It’s always good to stay aware of current events. What’s happened to others? Right. Pay attention to that and make sure those things don’t happen to you. And hey, obviously we all know this. This world we live in is going to be ever changing, right? If we put like a stone in a river, the river is going to find a way around the stone.
00:19:29:09 – 00:19:48:03
Actual
And we just got to see where the water goes, put another stone there and and just keep working it. It’s an ever changing kind of organic threat landscape to be prepared for, and it’s good to stay on top of the trends. Some of the topics we we’ve hit on in past episodes is where to find good threat Intel, for your specific industry is, you know, somewhere to look.
00:19:48:07 – 00:20:07:07
Actual
But this is good, too, to see what attackers are doing currently in the in the current time frame time period and maybe why. Right. So we have one that shut down operations, maybe drop drop the stock price. So if when we’re asking the question of why, it could be very well that somebody wanted to get Nike’s shares to drop right.
00:20:07:07 – 00:20:28:23
Actual
It could be a play on that. It could be a play to to buy, get them drop to buy, get them back up to sell something of that nature. Right. An attack of that way. With Nike, it could be very much the, the competitor. Right. The knockoff competitor who wants the IP so they can make their knockoff products is close to the real thing, if not almost exactly the real thing.
00:20:29:04 – 00:20:48:15
Actual
So they can summon stuff, right? That happens. And that’s why I like when, when, you know, when you talk about, let’s call it the startup world, IP is a big deal, right? It’s a big, big deal. And a lot of people, you know, when they become employed in these technology companies, you have to sign documents, you know, and you cannot take that IP.
00:20:48:15 – 00:21:03:11
Actual
It’s a every employee has to sign these documents. And it’s a big deal. If you leave that company and you bring some of that IP with you, right. So they’re on top of that. So that is a it is a thing. So yeah for this one we’re going to cut it here. We hit those those talking points.
00:21:03:11 – 00:21:26:19
Actual
We hit those marching orders. Things that you can take action on at this week just to make sure you’re doing your CIA right. Know what your, organization’s most important items are, and ask yourself how they’re being protected. All right? Assume not just assume that, you know, we can defend ourselves against ransomware attacks, but, do we have a process in place for high volume data being moved right out of the organization?
00:21:26:22 – 00:21:42:01
Actual
If maybe you haven’t looked into something like that? Look at that. Right. Do you have a plan in place and then, understand sort of the what materiality means if something does happen and, and what that process could look like if you ever need it, just to make sure you don’t get screwed on the back end. So that’s it for today’s episode.
00:21:42:03 – 00:21:50:02
Actual
Yeah. And next week we’re going to get into that match Group breach and we’ll discuss that one. So keep your head on a swivel and we’ll see you guys next week.
00:21:50:04 – 00:21:53:21
Actual
Mission. Success isn’t about luck. It’s about preparation.
00:21:53:23 – 00:21:56:22
Actual
You’ve heard the Intel. Now go put it to use.
00:21:57:00 – 00:22:04:08
Actual
If you need to verify your security posture. I’ve established a secure line at watcher 6.com/secure.
00:22:04:10 – 00:22:07:10
Actual
Go there to get the briefing the enemy doesn’t want you to have.
00:22:07:12 – 00:22:10:18
Actual
We’ll see you next week. Until then, keep your head on a swivel.
