Calsoft Systems listed on Sinobi ransomware leak site

• Ransomware group: Sinobi
• Country: United States
• Sector: Technology
• Announcement date: October 1, 2025

The Sinobi ransomware group has officially listed the United States-based technology firm Calsoft Systems on its dedicated leak site. According to the announcement made on October 1, 2025, the threat actor claims to have successfully exfiltrated a significant volume of data from the organization, totaling 305 GB. This development follows an alleged attack date of August 7, 2025.

The claims made by Sinobi

The threat actor known as Sinobi has announced a ransomware attack against Calsoft Systems by listing the company on its leak site. In the announcement, the group claims to have obtained sensitive information belonging to the organization. This type of activity is characteristic of modern ransomware operations, often referred to as double extortion. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage, threatening to publish it on a public leak site if the ransom is not paid.

The group has stated that they are holding the stolen data hostage and have issued a massive ransom demand. Specifically, the announcement specifies a demand of $11,380,000 USD in exchange for the withheld data. While information regarding the specific identity and technical capabilities of the Sinobi group remains limited, the high value of their ransom demand suggests that the group's primary motivations are likely financial in nature.

Data allegedly compromised in the attack

The announcement and accompanying evidence, such as screenshots, indicate that the breach involves a substantial amount of information. The group claims that the total volume of the alleged stolen data is 305 GB. The specific categories of information identified in the listing include:

• Financial data
• Customer data
• Contracts

About Calsoft Systems

Calsoft Systems is a business technology solutions provider specializing in the implementation and customization of Microsoft Dynamics ERP systems. The company offers IT support services and enterprise system integration to a variety of clients. Their service portfolio is specifically tailored to support industries including distribution, logistics, manufacturing, and travel.

Potential impacts and industry implications

This incident may create negative impacts on Calsoft Systems' operational continuity and customer trust. The alleged exposure of customer data and contracts could pose secondary risks for business partners operating in the distribution, logistics, manufacturing, and travel sectors. Because the organization is based in the United States, the incident may trigger legal processes under relevant state laws and federal data protection regulations.

Furthermore, the disclosure of this data could lead to targeted phishing attacks or identity theft attempts against the company's clients. When sensitive business contracts and customer details are leaked, the risk of subsequent social engineering attacks increases, as malicious actors can use the stolen information to craft highly convincing fraudulent communications.

For organizations operating within the technology and professional services sectors, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations to mitigate such risks include maintaining offline, immutable backups to ensure operational continuity, implementing strict access controls to limit data exposure, and conducting regular security awareness training to defend against phishing. Additionally, maintaining a comprehensive incident response plan is essential for navigating the legal and regulatory complexities that arise following a data breach.