Skip to content
Unilever
London, United Kingdom3 sources
Claimed:Whitearmor claimed it on a ransomware leak site on 5 Nov 2026. Not confirmed by the organisation, so treat it as a claim, not a fact.
Whitearmor claims ransomware attack on Unilever
Whitearmor claimed a ransomware attack on Unilever, the British multinational consumer goods company headquartered in London. The group threatened to leak sensitive data unless negotiations are initiated.
- Type
- Ransomware
- Sector
- Food
- Records
- 1.8M records claimed
- Claimed by
- Whitearmor
- First reported
- 5 Nov 2026
- Latest source
- 5 Nov 2026
What to do
- This is only a claim by the attackers so far. Do not panic, but do the basics:
- Expect delays if you rely on this organisation's services, and keep records of anything you are owed.
- If you have an account, change that password, and anywhere you reused it.
- Treat this as unverified. Ask the organisation directly before acting on it.
- If you connect to this organisation (VPN, file transfer, email), review and restrict those links until they confirm containment.
- Check that your own backups are offline or immutable and that you have tested a restore recently.
Not sure? Ask an assistant with the sources attached, or have a coding agent check your systems.
Check your systems for Unilever
Whitearmor has also hit
Sources
3- english.kyodonews.net5 Nov 2026english.kyodonews.net/articles/-/90309
- yazoul.net5 Nov 2026yazoul.net/intel/claim/2026-11-05-unilever-ransomware-claim-by-whitearmor-nov-2026
- hookphish.com5 Nov 2026hookphish.com/blog/ransomware-group-whitearmor-hits-unilever
Confidence 80% that this is real and correctly placed. Locations are city centroids at best. Spotted an error? Report a correction.