[ Ransomware claim · qilin · 6 Oct 2026 ]
CORBY ROCK MILL
The ransomware group qilin named CORBY ROCK MILL (Ireland) on its leak site on 6 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
The Irish Farmers Journal reported in early October 2026 that a cyber attack had seriously disrupted production, with the poultry mill running at reduced capacity and the ruminant mill out of action, while the company declined to confirm the nature of the incident.
- farmersjournal.ie
[ The organisation ]Who is CORBY ROCK MILL?
- What it does
- Corby Rock Mill is an Irish animal feed manufacturer and part of the Corby Rock Group, which combines feed milling with the rearing of point-of-lay pullets. It makes poultry feeds for breeders, broilers and layers as well as feeds for calves, dairy cows, beef cattle and sheep. The Irish Farmers Journal describes it as one of only two producers of specialised chicken feed on the island of Ireland.
- Based in
- Monaghan, County Monaghan, Ireland
- Founded
- 1975 (the feed mill; the group's egg and pullet business dates to 1973)
- Size
- more than 70 staff across the group, producing over 320,000 tonnes of feed a year, according to the company
- Who it serves
- Its customers are livestock farmers, in particular poultry producers, along with dairy, beef and sheep farmers, supplied directly and through merchants and distributors. It also offers farm services such as silage testing and a fodder calculator.
[ Impact ]Who could be affected
Poultry and livestock farmers who rely on its feed could face delayed or reduced deliveries, and press reports say other feed companies have been filling orders while its systems were down. Because it is one of only two specialised chicken feed producers on the island, a long disruption could put pressure on wider poultry feed supply. Farmers, merchants and staff whose contact or account details are held by the company could be affected if any data was accessed.
In manufacturing generally: Production stops ripple down the supply chain to customers waiting for parts and products, and groups often take design files and supplier contracts.
[ The attacker ]About qilin
Qilin, also known as Agenda, is a ransomware-as-a-service operation in which affiliates often get in with stolen or reused credentials or through internet-facing VPN and remote access devices, then steal data before encrypting systems. It is one of the most active groups of 2025 and 2026, and manufacturing is the sector it hits most often.
qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations qilin has named
- United States
- Chile
- Malaysia
- Germany
[ What to do ]If you are a customer, partner or neighbour
- Confirm orders, delivery dates and any change in feed formulation directly with the mill by phone using a number you already have.
- Treat emails or messages asking you to change payment details or bank accounts for feed invoices with suspicion and verify them by phone first.
- Watch for unexpected emails or calls that mention your farm account or recent orders, as contact details could be used for phishing.
- Plan a back-up feed supply with your merchant in case deliveries stay disrupted.