Milano listed on interlock ransomware leak site

• Ransomware group: interlock
• Country: Mexico
• Sector: Retail & E-Commerce
• Announcement date: March 13, 2025

Milano listed on interlock ransomware leak site

The Mexico-based retail company Milano has been listed on the leak site of the interlock ransomware group. According to the announcement made on March 13, 2025, the group claims to have gained access to the company's network and intends to release the stolen information publicly.

Details of the claimed attack

The interlock group asserts that they have successfully breached the network of Milano. The group claims that the breach occurred as early as December 1, 2023, though the announcement itself was posted on March 13, 2025. The attackers claim to have exfiltrated a total of 697 GB of data belonging to the organization.

This type of activity is characteristic of double extortion tactics often employed by ransomware groups. In such scenarios, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the data on a public leak site, the attackers aim to pressure the organization into meeting ransom demands to prevent the exposure of confidential records.

The scope of the alleged data theft

The leak announcement claims to include a wide variety of sensitive information. Based on the group's claims, the stolen data includes various categories of internal documentation and personal information. The provided screenshots associated with the leak show various directories that appear to contain accounting, marketing, operational records, and database backups.

The specific types of data allegedly compromised include:

• Employee personal data
• Financial reports
• Tax records
• Operational data

No information was provided regarding the specific ransom demand or the exact file count involved in this incident.

About Milano

Servicios Corporativos Melody-Milano is a Mexico-based apparel and accessories retailer. The company operates as a retail chain offering a variety of fashion products.

Potential impact and security implications

This breach may pose secondary risks such as identity theft and targeted phishing attacks for the company's employees due to the exposure of their personal data. Furthermore, the exposure of financial data could lead to reputational damage and competitive disadvantages for the firm. It is also possible that the company may face legal sanctions under Mexican data protection regulations.

Information regarding the interlock group remains limited. Given the sensitivity of the data involved, organizations facing similar threats may need to conduct an urgent security audit and notify the affected parties to mitigate further damage.

In the retail and e-commerce sectors, protecting sensitive customer and operational data is a critical component of cybersecurity posture. Common defensive steps for organizations include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments to identify potential entry points for attackers. Monitoring for unauthorized data exfiltration can also help in detecting a breach before large volumes of data are moved out of the network.