Callipo Group listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Italy
• Sector: Agriculture and Food Production
• Announcement date: December 22, 2025

Qilin ransomware group claims attack on Callipo Group

The Qilin ransomware group has listed the Italian organization Callipo Group on its dedicated leak site. According to the announcement, the threat actor claims to have compromised data belonging to the company. The incident was allegedly carried out on December 22, 2025, and was officially announced on the group's leak site on December 22, 2025.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These platforms serve as a public gallery where threat actors post information about their targets. When a victim refuses to meet the group's demands, the attackers may release stolen data to cause maximum reputational and operational damage. This tactic is a central component of modern cyber extortion campaigns.

Details of the alleged incident

The threat actor known as Qilin has identified the target as an entity operating within the agriculture and food production sector. Despite the public listing, the group has not disclosed any specific details regarding the scope of the breach. Specifically, the announcement does not include a ransom demand, nor has the group provided information regarding the total volume of data stolen or the specific file count involved in the incident.

At this stage, the listing names no specific data types or categories of information that have been compromised. There are no screenshots or detailed descriptions provided by the threat actor to illustrate the nature of the alleged leaked data.

About Callipo Group

Callipo Group is a well-established Italian food company known primarily for its canned tuna and traditional Calabrian food products. Founded in 1913, the company specializes in seafood and local delicacies.

Potential implications and industry risks

Qilin is a Ransomware-as-a-Service (RaaS) group that has been active since 2022. The group is recognized for employing double extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release. This dual-layered approach significantly increases the pressure on the victim to comply with demands.

This claim may lead to operational disruptions for the organization and could trigger legal processes under GDPR depending on the nature of the compromised data. Furthermore, secondary risks such as identity theft or targeted phishing attacks against employees and customers may emerge as a result of the breach. Given the organization's role in the food supply chain, it is possible that this incident could result in a broader loss of trust within the sector.

For organizations operating in critical supply chains like food production, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. Because these attacks often target sensitive business intelligence or customer information, proactive monitoring and incident response planning are vital to mitigating the long-term impact of such claims.