Cadorim listed on Killsec leak site following alleged data breach

• Ransomware group: Killsec
• Country: Belgium
• Sector: Manufacturing
• Announcement date: September 22, 2025

Killsec claims to have breached Cadorim

The threat actor known as Killsec has officially listed the Belgian organization Cadorim on its dedicated leak site. According to the announcement made on September 22, 2025, the group claims to have initiated a ransom process against the company. This development follows the group's claim of having gained unauthorized access to the organization's internal data, a tactic often associated with double extortion ransomware campaigns.

In such scenarios, threat actors typically employ a multi-layered extortion strategy. First, they encrypt the victim's systems to disrupt business operations, and second, they threaten to publish sensitive information on a public leak site if the ransom demand is not met. This pressure tactic is designed to force the victim into payment by leveraging the threat of reputational damage and regulatory scrutiny. While the group has posted evidence to support their claims, the full extent of the breach remains to be verified.

The announcement provided by the group includes sample files intended to serve as evidence of the alleged breach. These samples are used by the attackers to demonstrate that they have successfully exfiltrated data from the target's network, thereby increasing the pressure on the victim to comply with their demands.

Data involved in the alleged leak

The information provided by the threat actor regarding the specific contents of the breach is limited. The group has not provided a detailed breakdown of the full scope or the exact nature of the leaked data. However, the provided screenshots include examples of identification cards and various document images, which serve as a visual confirmation of the types of files the group claims to possess.

Based on the evidence presented in the leak site announcement, the following types of data are reportedly affected:

• Identity information
• Corporate documents

It is important to note that the group has not disclosed the total volume of data stolen or the specific number of files involved in the incident. Additionally, no specific ransom demand has been publicly detailed in the announcement.

About Cadorim

Cadorim is a manufacturing and industrial solutions company based in Belgium. The organization operates primarily in the field of technical equipment and industrial processes, serving the needs of the manufacturing sector through specialized industrial solutions.

Risk assessment and industry implications

This alleged breach poses significant risks to the organization and the individuals whose data may have been exposed. Because Cadorim is based in Belgium, any confirmed leak of personal information could lead to legal sanctions and administrative fines under the EU General Data Protection Regulation (GDPR). The exposure of identity documents significantly increases the risk that affected individuals may be targeted by identity theft or sophisticated phishing attacks.

The motivation of the Killsec group is also a point of interest for threat intelligence analysts. Having emerged in 2023 with reported hacktivist origins, the group's objectives may fluctuate between seeking financial gain and engaging in ideological posturing. This unpredictability adds a layer of complexity to the incident response process for the victim.

Furthermore, the impact of such a breach often extends beyond the primary target. In the manufacturing sector, organizations are deeply integrated into complex supply chains. Consequently, a breach at a company like Cadorim can create secondary risks for its various supply chain partners and customers, who may also face exposure through interconnected digital systems or shared documentation.

To mitigate such risks, organizations in the industrial and manufacturing sectors typically prioritize robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized access, and ensuring that all software and hardware are regularly patched. Additionally, maintaining a strong incident response plan and conducting regular data protection impact assessments are essential steps for managing the legal and operational risks associated with potential data exposure.