Centurion Security & Investigations listed on Sinobi ransomware leak site

• Ransomware group: Sinobi
• Country: United States
• Sector: Professional Services
• Announcement date: December 16, 2025

Sinobi ransomware group targets Centurion Security & Investigations

The Sinobi ransomware group has officially listed Centurion Security & Investigations on its dedicated leak site. According to the announcement made on December 16, 2025, the threat actor claims to have successfully breached the organization and encrypted its internal data. This development follows a common pattern in modern cyberattacks known as double extortion, where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations.

In such scenarios, ransomware groups typically use a leak site to pressure victims into paying. By publishing screenshots or lists of stolen files, these actors aim to damage the reputation of the target organization and create public pressure to meet their financial demands. While the breach is claimed by the group, the full extent of the impact remains to be verified through independent investigation.

Details of the alleged attack and ransom demand

The threat actor known as Sinobi announced the attack on December 16, 2025, the same day the listing appeared on their leak site. The group claims to have completed the encryption of the organization's data and has issued a significant ransom demand. Specifically, the group is demanding a payment of 17,900,000 USD to prevent further exposure or to restore access to the encrypted systems.

To support their claims, the attackers have provided evidence in the form of screenshots. These images are allegedly taken directly from the organization's internal servers, serving as proof to the victim and the public that the intrusion was successful. Such tactics are designed to increase the psychological pressure on the target organization's leadership during the negotiation phase.

Scope of the allegedly leaked data

The full scope of the data allegedly stolen or leaked by the Sinobi group has not been specified in the announcement. However, the provided screenshots offer some insight into the environment that was targeted. The images display various file directories that appear to originate from a Windows Server 2019 environment.

• File directories from a Windows Server 2019 environment

Organizational impact and potential risks

This incident may negatively impact the operational continuity of Centurion Security & Investigations. When a ransomware group successfully encrypts an organization's data, it can lead to significant downtime and the inability to perform core business functions. Furthermore, such a public listing can lead to a decline in client trust, as clients often expect high levels of data protection from professional service providers.

Because the organization is based in the United States, a confirmed data breach could trigger various state-level data protection laws and initiate formal regulatory oversight processes. The exposure of sensitive information can create secondary risks for the organization's clients and employees, including the potential for identity theft or targeted phishing attacks. These secondary attacks often occur when stolen credentials or personal identifiers are sold on the dark web or used by other malicious actors.

Assessment of the threat actor

Regarding the Sinobi group, public information remains limited. Due to this lack of available intelligence, a definitive assessment regarding the group's specific methods, technical capabilities, or underlying motivations cannot be made at this time. Organizations facing similar threats often focus on robust defensive measures, such as maintaining offline backups, implementing multi-factor authentication, and conducting regular security audits to mitigate the risk of such intrusions.