DelCampo targeted by Qilin ransomware group in data leak claim

• Ransomware group: Qilin
• Country: El Salvador
• Sector: Agriculture and Food Production
• Announcement date: July 23, 2025

The Qilin ransomware group has officially listed the agricultural company DelCampo on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated data belonging to the organization and has proceeded to publish this information as part of their extortion tactics.

Details of the alleged attack

The announcement regarding DelCampo was posted on the Qilin leak site on July 23, 2025. While the specific date the group claims to have carried out the attack is June 21, 2025, the primary focus of the leak site post is the public disclosure of stolen information. The group alleges that they have gained unauthorized access to the company's systems and has moved to release the gathered data to the public.

The leak site announcement includes various visual evidence intended to prove the validity of the breach. These include screenshots and images that appear to contain documents related to the organization's internal operational processes. The presence of such images is a common tactic used by ransomware groups to demonstrate the success of their intrusion and to increase pressure on the victim organization.

Data types involved in the leak

Based on the information provided by the Qilin group, the leaked content includes a variety of sensitive documents. The screenshots provided in the announcement specifically display several categories of information that could impact the organization's privacy and security. The data identified in the leak includes:

• Financial data
• Operational documents
• Personal identification information

The inclusion of personal identification cards and financial statements suggests that the breach extends beyond mere corporate files and into the private information of individuals associated with the company.

About DelCampo

DelCampo is a third-generation, family-owned business that specializes in the production and distribution of fresh produce. The company operates as a vertically integrated business, managing various stages of the supply chain. They grow fruits and vegetables year-round using state-of-the-art greenhouses located in Sinaloa and Jalisco, Mexico.

Impact and risk assessment

The claim of this data breach carries several significant risks for the organization and its stakeholders. The exposure of personal identification information poses a direct risk of identity theft for the company's employees and customers. Furthermore, the release of financial and operational data could potentially increase the risk of secondary attacks targeting the company's commercial operations, as adversaries may use the leaked information to craft more convincing social engineering or phishing campaigns.

Because the Qilin group is known for employing double-extortion tactics—a method where attackers both encrypt data and threaten to leak it—it is possible that the pressure on the organization may escalate. Double extortion is a common ransomware strategy designed to maximize leverage over a victim by threatening the reputational and regulatory consequences of a data leak, even if the company can recover its systems from backups.

The scope of this data breach may also trigger legal and administrative processes for the company under local data protection regulations. In the agricultural and food production sector, maintaining the integrity of supply chain data and protecting the privacy of a large workforce and customer base is critical for maintaining trust and regulatory compliance.

To mitigate such risks, organizations in this sector often focus on strengthening their defensive postures. This typically involves implementing robust access controls, enhancing monitoring of data exfiltration, and ensuring that sensitive personal and financial information is encrypted both at rest and in transit. Additionally, maintaining a comprehensive incident response plan is a standard defensive step to manage the legal and operational fallout when a breach is claimed by a ransomware group.