Callipo Group targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: Italy
• Sector: Agriculture and Food Production
• Announcement date: December 19, 2025

Medusa ransomware group claims attack on Callipo Group

The Medusa ransomware group has officially listed the Callipo Group on its dedicated leak site. In a recent announcement, the threat actor group claimed to have successfully compromised the company's data, marking a new incident for the Italian food production sector. This announcement, posted on December 19, 2025, follows an alleged attack date of December 17, 2025.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. These sites are used to host lists of compromised organizations and, in many cases, provide proof of the breach to validate the attackers' claims. By publishing these names, ransomware groups aim to damage the reputation of the target and coerce them into meeting financial demands.

The extortion attempt and group demands

According to the claims made by the Medusa group, the organization is being subjected to a double extortion tactic. This method involves not only encrypting a company's internal systems to disrupt operations but also stealing sensitive information to use as leverage. The group has demanded a ransom of 200,000 dollars in exchange for their agreement not to publish the stolen data publicly.

To support their claims of a successful breach, the group has shared various file samples and visual evidence. These materials are presented by the attackers as proof that they have gained access to the company's internal operational processes. The presence of such evidence is a common tactic used by ransomware groups to demonstrate the legitimacy of their intrusion and increase the psychological pressure on the victimized organization.

Potential data exposure and affected information

The evidence provided by the Medusa group includes screenshots of various files. These files appear to be in a table-like format, which suggests they may contain structured information used for business administration. Based on the visual evidence provided in the leak site announcement, the following types of data are claimed to be involved in the breach:

• Financial data
• Personnel information
• Operational reports

The exposure of such information can have significant consequences for an organization. When sensitive data is leaked, it can lead to secondary risks, such as identity theft or targeted phishing attacks against employees or clients. Furthermore, the disclosure of internal operational reports can provide outsiders with insight into the company's private business workflows.

About Callipo Group

Callipo Group is a long-standing food company that has been producing high-quality tuna and fish preserves in Italy for over 110 years. The company also operates in the fields of ice cream production, tourism and hospitality services, and agricultural activities.

Impact and risks for the food production sector

This incident may lead to the disruption of the company's commercial activities and the exposure of sensitive data. As the company operates in Italy, it may face administrative sanctions due to data protection obligations under GDPR. The Medusa group's double extortion method suggests that the leaked data could be used for secondary risks such as identity theft and targeted phishing attacks. The company's supply chain partners may also be affected, potentially leading to a loss of trust.

In the food and agriculture sector, supply chain integrity is vital. A breach in one major producer can create ripple effects throughout the distribution network, potentially impacting partners who rely on the company's operational consistency. Organizations in this sector often face complex regulatory environments regarding both food safety and data privacy.

The Medusa group, which has been active since 2021, typically publishes data publicly if the ransom is not paid. This behavior underscores the high stakes involved in ransomware negotiations. To defend against such threats, organizations generally focus on implementing robust backup strategies, maintaining strict access controls, and conducting regular security awareness training to mitigate the risk of initial entry through phishing or other common vectors.