Autorotor listed on dragonforce leak site

• Ransomware group: dragonforce
• Country: Italy
• Sector: Manufacturing
• Announcement date: October 27, 2025

The manufacturing company Autorotor has been listed on the leak site of the dragonforce group. This announcement, made by the threat actor, indicates a potential cybersecurity incident involving the Italian organization.

The claimed attack and event details

The dragonforce group listed Autorotor on its leak platform on October 27, 2025. According to the announcement, the threat actor claims to have gained access to the organization's networks. While the listing appeared on the group's platform in late October, the group claims the attack occurred on October 14, 2025.

In many ransomware scenarios, threat actors utilize leak sites to pressure victims into paying ransoms. This often involves a double extortion tactic, where the attackers not only encrypt a company's systems but also threaten to release sensitive information to the public or specific stakeholders. Such tactics are designed to maximize the pressure on an organization to comply with financial demands.

Despite the listing, the announcement remains vague regarding the specifics of the intrusion. At this time, no data samples have been shared by the group, and no ransom demands have been issued within the public announcement provided by the threat actor.

Information regarding the alleged data leak

The nature of the data involved in this incident remains unclear. The announcement does not provide any information or screenshots regarding the nature of the data allegedly leaked. Furthermore, the listing does not specify the volume of the data or the number of files involved in the breach.

The listing names no specific data types that have been compromised.

About Autorotor

Autorotor is an Italian company that manufactures custom machinery such as rotary tables, transport belts, and robotic handling equipment for factories and manufacturing plants. The company provides solutions aimed at increasing the efficiency and speed of industrial production lines.

Risk assessment and industry implications

This situation may result in the risk of sensitive corporate data being exposed. If data is leaked, it could lead to disruptions in corporate processes and the disclosure of trade secrets. For an organization operating in the manufacturing sector, the loss of proprietary designs or production methodologies can have significant long-term consequences.

As the organization is based in Italy, potential violations of data protection obligations under the GDPR may be considered. Regulatory frameworks like the General Data Protection Regulation require strict adherence to data security and notification protocols to protect individual privacy and corporate information.

The dragonforce group emerged in 2023 and is reported to follow a model of providing infrastructure to affiliates, which may indicate that attack patterns could vary. This decentralized approach can make it difficult for defenders to predict specific tactics, as different affiliates may use different methods to penetrate a network.

Secondary risks, such as the use of leaked data for identity theft or targeted phishing attacks, should be evaluated. Organizations facing such threats often implement defensive measures such as multi-factor authentication, regular network monitoring, and robust backup strategies to mitigate the impact of unauthorized access and potential data exfiltration.