Clop ransomware group lists ACRONI.SI on its leak site

• Ransomware group: Clop
• Country: Slovenia
• Sector: Manufacturing
• Announcement date: November 21, 2025

Clop group claims Acroni has neglected security measures

The Clop ransomware group has officially announced the addition of the Slovenian organization Acroni to its leak portal. According to the announcement made on November 21, 2025, the threat actor group claims that the organization has neglected its security measures. This listing follows the group's established pattern of targeting high-value entities and using public leak sites to exert pressure on victims.

The announcement was posted on the group's dedicated leak site on November 21, 2025, the same date the group claimed the attack occurred. At this stage, the group has not disclosed any specific ransom demand, nor have they provided information regarding the total volume of data they claim to have exfiltrated. The listing serves as a public notification of the alleged breach, a common tactic used in modern ransomware operations to damage an organization's reputation and force compliance.

No details provided regarding stolen data

Despite the listing of the organization on the Clop leak site, the group has remained vague regarding the specific contents of the alleged breach. Currently, no details or sample files regarding the content of the alleged leaked data have been provided by the attackers. Furthermore, the listing names no specific data types that have been targeted or compromised during the alleged incident.

In many ransomware scenarios, threat actors employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish private data on public forums or leak sites, the group increases the pressure on the victim to pay the ransom. While the contents of the data in the Acroni case remain unknown, this methodology is a hallmark of the group's operations.

About Acroni

SIJ Acroni is a steel manufacturer based in Slovenia, specializing in the production of stainless steel plates and electrical steel. The company operates as part of the SIJ Group, representing a significant player within the regional manufacturing sector.

Analysis and potential implications

The Clop group is known for orchestrating large-scale data breaches by exploiting vulnerabilities in file transfer software. This situation may indicate that unauthorized access to the organization's systems could have occurred. Given the group's past tactics, the possibility that the attack originated from supply chain vulnerabilities should be considered, as attackers often target third-party software to gain access to primary targets.

If the breach is confirmed, several significant risks and consequences may arise:

• Legal and regulatory consequences: If a breach is confirmed, legal proceedings and administrative sanctions under GDPR (EU) regulations in Slovenia may be initiated.
• Secondary cyber risks: If the data is published, secondary risks such as identity theft or targeted phishing attacks against employees and customers may arise.

For organizations operating in the manufacturing sector, maintaining robust security posture is critical. This includes implementing strict patch management to address vulnerabilities in file transfer and other external-facing software. Organizations should also consider adopting a zero-trust architecture and enhancing monitoring capabilities to detect unauthorized access early. Furthermore, securing the supply chain by auditing the security practices of third-party vendors is a vital step in preventing indirect entry into corporate networks.