Calcadawines listed on nightspire leak site

• Ransomware group: nightspire
• Country: Portugal
• Sector: Agriculture and Food Production
• Announcement date: May 24, 2025

The Portuguese-based agriculture and food production company Calcadawines has been listed on a ransomware leak site by a threat actor group known as nightspire. The announcement, posted on May 24, 2025, claims that the organization has fallen victim to a cyber incident.

Details of the alleged incident

According to the claims made by the nightspire group, the cyber incident occurred on May 23, 2025. The group asserts that they successfully obtained a significant amount of data during this event. While the group has made this public claim on their leak site, information regarding the specific identity, tactics, or background of the nightspire group remains limited.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. If the victim refuses to pay the ransom to unlock their systems, the attackers threaten to publish the stolen information on these public leak sites to cause reputational or regulatory harm.

Data involved in the claim

The nightspire group claims to have acquired 70 GB of data belonging to Calcadawines. At this time, no detailed information or screenshots regarding the specific content of the allegedly leaked data have been provided by the attackers. Furthermore, the listing does not specify the total number of files involved or the specific nature of the files stolen.

Affected data types

The listing names no specific data types.

About Calcadawines

Calcadawines is a wine producer and agricultural business based in Portugal. The company engages in viticulture and wine production using traditional regional methods.

Risk assessment and organizational implications

This alleged data leak may pose significant risks to the institution's operational continuity and commercial reputation. The potential exposure of sensitive data to third parties can trigger secondary risks, such as identity theft or targeted phishing attacks against the organization or its stakeholders.

If the leaked data includes employee or customer information, it could lead to data protection violations under the General Data Protection Regulation (GDPR) within the European Union. Consequently, the organization may need to review its data security processes and evaluate its legal notification obligations regarding potential data breaches.

In the agriculture and food production sector, maintaining the integrity of supply chain data and customer information is vital for business stability. Organizations facing such threats often prioritize the following defensive and reactive steps:

• Incident Response: Activating a formal incident response plan to contain the breach and investigate the entry point.
• Data Protection Compliance: Assessing whether the breach necessitates mandatory notifications to regulatory authorities and affected individuals under frameworks like GDPR.
• Security Review: Evaluating existing data security processes and implementing stronger controls to prevent future unauthorized access.
• Monitoring: Increasing vigilance against secondary threats, such as phishing campaigns that often follow a data leak.

As of the current reporting, the full extent of the breach and the specific contents of the 70 GB of data remain unverified by the victim.