CCL Products India data allegedly leaked by Skira ransomware group

• Ransomware group: Skira
• Country: India
• Sector: Manufacturing
• Announcement date: March 6, 2025

Skira ransomware group claims data breach at CCL Products India

The threat actor group known as Skira has listed data allegedly belonging to CCL Products India on their leak site. According to the announcement made on March 6, 2025, the group claims to have exfiltrated approximately 1.4 TiB of data from the organization. This incident follows a pattern often seen in modern cyberattacks, where threat actors utilize leak sites to pressure victims by threatening to publish sensitive information if specific demands are not met.

In many ransomware campaigns, groups employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also focus on stealing sensitive data before the encryption phase. By threatening to release this data publicly, the attackers aim to maximize their leverage, targeting the victim's reputation and legal standing to ensure payment.

Details of the alleged exfiltration

The Skira group has published information on their platform that they claim was extracted directly from the ERP systems of CCL Products India. The threat actors allege that the compromised data is highly sensitive, specifically highlighting that the stolen information includes ERP databases and source codes. One specific detail mentioned in the announcement is an ERP database backup, which is estimated to be 621 GiB in size.

While the group has provided details regarding the nature of the files, no information was provided regarding the specific ransom demand or the total file count involved in the breach. The announcement was made on the same day as the claimed attack date, March 6, 2025.

Alleged affected data types

• ERP databases
• Source codes

About CCL Products India

CCL Products India is one of the world's largest manufacturers of instant coffee. The company produces a variety of coffee products and exports them to numerous countries worldwide.

Potential impact and organizational risks

The alleged exfiltration of ERP data may pose significant risks to the organization's operational processes and trade secrets. The disclosure of such sensitive information could potentially weaken the organization's competitive advantage and lead to disruptions in supply chain operations. Furthermore, the leaked data could potentially be utilized by malicious actors for identity theft or targeted phishing attacks against the company or its partners.

From a regulatory perspective, the organization may face legal responsibilities under the data protection regulations in place in India. When such breaches occur, organizations typically face a complex landscape of compliance requirements and the need for forensic investigation to determine the full scope of the compromise.

For organizations operating within the manufacturing sector, maintaining robust cybersecurity postures is essential to protect proprietary information and supply chain integrity. Common defensive steps for organizations to mitigate such risks include implementing strict access controls for ERP systems, maintaining offline backups of critical databases, and conducting regular security awareness training to prevent initial access through phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring comprehensive logging of system activities can help in the early detection of such incidents.

Information regarding the Skira group remains limited, as the group's specific tactics, techniques, and procedures are not yet widely documented in public intelligence. As with all reported leaks, the information provided by the threat group remains unconfirmed and is based solely on the claims made by the attackers on their platform.