Lipapromet listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Croatia
• Sector: Manufacturing
• Announcement date: October 6, 2025

The Qilin ransomware group has officially listed the Croatian company Lipapromet on its dedicated leak site. According to the announcement made on October 6, 2025, the threat actor group claims to have successfully exfiltrated data from the organization, marking a new target for the group's extortion activities.

The claimed attack and extortion tactics

The Qilin ransomware group announced the breach on October 6, 2025, asserting that they have gained unauthorized access to the internal systems of Lipapromet. The group's announcement is a clear indication of their ongoing use of double-extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data publicly, the attackers aim to increase the pressure on the victim organization to meet their ransom demands.

The group's claim suggests a targeted approach aimed at maximizing the impact of the breach. By targeting specific internal documents, the attackers seek to create a situation where the organization faces significant pressure from various stakeholders, including business partners and regulatory bodies. This method of extortion is designed to exploit the sensitivity of the stolen information, making the threat of a public leak a powerful tool for the criminals.

Compromised data and evidence

The announcement from the Qilin group specifies that several categories of sensitive internal information have been compromised during the attack. The group alleges that they have accessed critical business documentation that could be highly damaging if released. According to the claims, the following types of data have been exfiltrated:

• Accounting records
• Contracts
• Financial obligations

To support their claims, the threat actors provided a screenshot containing samples of various documents and tables. These samples are intended to serve as proof of the breach to the organization and the public. While the specific volume of data or the exact number of files taken have not been disclosed by the group, the presence of these document samples highlights the potential severity of the data exposure.

About Lipapromet

Lipapromet is a Croatian company that has been operating since 1990. Headquartered in Zagreb, the organization specializes in the development and supply of LED lighting solutions. The company serves a wide range of clients, providing specialized lighting systems for various industrial and commercial sectors. As an established player in the manufacturing and lighting solutions industry, the company maintains various commercial and financial relationships essential to its operations.

Impact assessment and organizational implications

This incident may have significant consequences for Lipapromet's operational continuity and its commercial reputation. The exposure of sensitive business documents, such as contracts and financial records, can lead to a loss of trust among clients and partners. Furthermore, because the company operates within Croatia, the leaked data may fall under the scope of the GDPR (EU General Data Protection Regulation). This regulatory framework imposes strict requirements on how personal and sensitive data is handled, and a breach of this nature could potentially lead to legal sanctions and investigations.

The use of double-extortion methods introduces secondary risks that extend beyond immediate operational disruptions. The exposure of sensitive data can facilitate targeted phishing campaigns against the organization or its partners, and it may also expose the company to risks of corporate espionage. Qilin's historical patterns indicate a high likelihood of publicly releasing stolen data if their ransom demands are not met, which heightens the urgency for the affected organization.

For organizations operating in similar sectors, such incidents underscore the necessity of robust cybersecurity defenses. Implementing strong access controls, continuous monitoring of internal networks, and comprehensive data encryption are standard defensive steps. Furthermore, maintaining a clear incident response plan and ensuring compliance with regional data protection regulations, such as GDPR, are critical components of a modern cybersecurity strategy to mitigate the impact of both operational disruptions and the secondary risks associated with data exfiltration.