FirstFruits Farms Data Breach Exposes Sensitive Information of Thousands
FirstFruits Farms, LLC, a major agricultural company based in Prescott, Washington, confirmed a data breach after detecting unusual activity in its systems on September 12, 2025. The company, which operates over 10,000 acres across Washington and Michigan and employs up to 2,800 workers, secured its environment and launched an investigation with cybersecurity experts, concluding on December 18, 2026.
The breach was reported to the Washington Attorney General’s Office on January 16, 2026, with 6,335 Washington residents notified that their personal data may have been compromised. The cybercriminal group Akira claimed responsibility for the attack on November 21, 2025, asserting they had exfiltrated 26 GB of data, including employee and customer records. The investigation later confirmed that sensitive information was accessed.
Exposed data includes:
- Names
- Social Security numbers
In response, FirstFruits Farms offered affected individuals 12 months of complimentary identity protection services through IDX, including credit monitoring, dark web monitoring, a $1 million identity fraud reimbursement policy, and identity theft recovery services. The enrollment deadline is March 29, 2026.
Class action law firm Shamis & Gentile P.A. is investigating potential legal claims for those impacted by the breach.
Source: https://www.claimdepot.com/investigations/firstfruits-farms-data-breach-2026
FirstFruits Farms LLC cybersecurity rating report: https://www.rankiteo.com/company/firstfruits-farms
"id": "FIR1768948439",
"linkid": "firstfruits-farms",
"type": "Breach",
"date": "9/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '6,335 Washington residents',
'industry': 'Agriculture',
'location': 'Prescott, Washington, USA',
'name': 'FirstFruits Farms, LLC',
'size': '10,000 acres, 2,800 employees',
'type': 'Agricultural Company'}],
'customer_advisories': '12 months of complimentary identity protection '
'services through IDX (credit monitoring, dark web '
'monitoring, $1 million identity fraud reimbursement, '
'identity theft recovery services). Enrollment '
'deadline: March 29, 2026.',
'data_breach': {'data_exfiltration': 'Yes (26 GB)',
'number_of_records_exposed': '6,335 Washington residents',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Social Security numbers']},
'date_detected': '2025-09-12',
'date_publicly_disclosed': '2026-01-16',
'date_resolved': '2026-12-18',
'description': 'FirstFruits Farms, LLC, a major agricultural company based in '
'Prescott, Washington, confirmed a data breach after detecting '
'unusual activity in its systems on September 12, 2025. The '
'breach exposed sensitive information, including names and '
'Social Security numbers of thousands of individuals.',
'impact': {'data_compromised': '26 GB of data', 'identity_theft_risk': 'High'},
'investigation_status': 'Concluded',
'ransomware': {'data_exfiltration': 'Yes'},
'references': [{'source': 'Washington Attorney General’s Office'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Shamis & Gentile P.A.',
'regulatory_notifications': 'Washington Attorney '
'General’s Office'},
'response': {'communication_strategy': 'Notification to affected individuals '
'and Washington Attorney General’s '
'Office',
'containment_measures': 'Secured environment',
'incident_response_plan_activated': 'Yes',
'third_party_assistance': 'Cybersecurity experts'},
'threat_actor': 'Akira',
'title': 'FirstFruits Farms Data Breach Exposes Sensitive Information of '
'Thousands',
'type': 'Data Breach'}