Dugoni listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Italy
• Sector: Professional Services
• Announcement date: June 9, 2025

The Qilin ransomware group has listed the Italian company Dugoni on its dedicated leak portal, alleging that the organization has been the victim of a data breach. According to the announcement, the threat actor group claims to have successfully breached the company's systems and exfiltrated data. This development follows a pattern of activity observed from the group, which has been active since 2022 and is known for targeting various sectors using similar methodologies.

The alleged attack and group claims

The announcement regarding the alleged breach of Dugoni was reportedly created on June 9, 2025. The Qilin ransomware group claims that the attack occurred on June 8, 2025. Through their leak site, the group asserts that they gained unauthorized access to the organization's internal systems, allowing them to extract information from the network. This type of public listing is a hallmark of modern ransomware operations, where threat actors use the threat of leaking sensitive information to pressure victims into meeting ransom demands.

Ransomware leak sites serve as a platform for extortion, where groups post the names of their victims to increase visibility and pressure. When a group uses these sites, they often employ a tactic known as double extortion. In a double extortion scenario, the attackers do not merely encrypt the victim's data to disrupt operations; they also steal sensitive information beforehand. The threat of releasing this stolen data publicly or selling it on the dark web provides the attackers with additional leverage, as the victim faces not only operational downtime but also significant reputational and legal consequences.

Details regarding the alleged data breach

While the Qilin group has officially listed Dugoni on their portal, they have not provided specific details regarding the nature or the content of the allegedly leaked data. The announcement remains vague concerning the specific files or types of information that were targeted during the breach. Consequently, the listing names no specific data types.

Potential risks of exfiltrated data

Although the exact contents of the breach remain unknown, the use of double extortion tactics suggests that any exfiltrated data could be utilized for malicious purposes in the future. This often includes identity theft or the execution of highly targeted phishing attacks against the organization, its employees, or its clients. Such attacks leverage the stolen information to appear legitimate, making it harder for individuals to detect the fraudulent communication.

Organization profile

Dugoni is a facility management and commercial cleaning services company based in Mantua, Italy. Operating within the professional services sector, the firm employs between 20 and 49 people. As a provider of facility management and commercial cleaning, the company plays a role in the operational infrastructure of its clients.

Impact assessment and industry implications

This alleged breach by the Qilin group may negatively impact the organization's operational continuity and commercial reputation. For an entity operating in the facility management sector, such an incident can pose significant supply chain risks. Because these companies often manage the physical environments and operational workflows of other businesses, a compromise in their security can have ripple effects across their client base.

Furthermore, as an Italy-based entity, any potential data breach could lead to legal and administrative sanctions under the European Union's General Data Protection Regulation (GDPR). The regulatory framework in the EU imposes strict requirements on how personal data must be protected and how breaches must be reported. Failure to comply with these standards can result in substantial fines and legal scrutiny.

To mitigate such risks, organizations across various sectors are encouraged to implement robust defensive measures. These typically include maintaining rigorous patch management schedules, enforcing multi-factor authentication (MFA) across all access points, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, encrypted backups and implementing network segmentation can help limit the lateral movement of an attacker and ensure that operational continuity can be restored more effectively in the event of a successful intrusion.