Centra Sota Cooperative

Centra Sota Cooperative, a member-owned agricultural cooperative based in Minnesota, has been named on the leak site of the WorldLeaks ransomware group. According to Ransomware.live, the group listed the cooperative, whose domain is centrasota.com, on June 10, 2026, claiming it had stolen company data during an attack. Malware.news reported that the group threatened to publish sensitive information unless a ransom was paid, citing an actor statement that company data had been encrypted and would be leaked. The investigation team later indexed a dataset tied to the listing containing 93,417 rows and estimates the attack occurred on or around June 10, 2026.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

What Information Was Compromised?

Our analysis found the following data types in this breach:

Street addresses in all 93,417 rows

Dates of birth in 77,437 rows

Names in 73,949 rows

Phone numbers in 47,886 rows

Social Security numbers in 25,991 rows

Email addresses in 15,462 rows

Vehicle identification numbers (VINs) in 590 rows

Driver's license numbers in 19 rows

Public reporting, including GalaxyWarden, describes the stolen material as internal files exfiltrated from the cooperative's systems rather than a single structured customer database. Internal business files often contain a mix of the record types listed above.

Not every individual is affected by every type of data listed here.

The investigation team has not confirmed a company notice describing the incident, and the full scope of who is affected remains unclear.

What Are the Potential Risks for Affected Individuals?

The most serious exposure here is the combination of Social Security numbers with names, birth dates, and addresses. Together, those fields are enough for someone to attempt identity theft, open fraudulent credit accounts, or file fake tax returns in another person's name.

Phone numbers and email addresses in the dataset are useful for phishing. Scammers may impersonate the cooperative, a bank, or a government agency, using real details from the breach to sound convincing. Farmers and cooperative members should treat unexpected calls, texts, or emails asking for payment or account details with suspicion.

Vehicle VINs and driver's license numbers are smaller exposures but can still support targeted fraud or harassment of specific individuals.

What Should You Do If You Were Affected?

If you are a member, customer, or employee of Centra Sota Cooperative, take these steps:

Place a fraud alert or a credit freeze with the three major credit bureaus, Equifax, Experian, and TransUnion. A freeze is free and blocks most new credit from being opened in your name.

Review your credit reports for accounts you do not recognize. You can pull free reports from each bureau at AnnualCreditReport.com.

Watch for phishing. Do not click links or share codes from unexpected messages, even ones that appear to reference the cooperative.

If you file taxes, consider getting an IRS Identity Protection PIN to stop someone from filing a return in your name.

Change passwords on any accounts tied to your cooperative or work email, and turn on two-factor authentication where it is offered.

Monitor bank and card statements for charges you did not make.

Because there is no confirmed company notification available at this point, monitor your email and mail for official correspondence from Centra Sota Cooperative before acting on any notice claiming to come from the organization. Verify such notices independently.