Qilin ransomware group lists goodcents.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: September 20, 2025

Qilin claims data breach at goodcents.com

The threat actor known as Qilin has published a leak announcement targeting goodcents.com. According to the claim, the group has gained access to the organization's systems and exfiltrated various data. This announcement appeared on the group's leak platform with a discovery date of September 20, 2025.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. These sites often host stolen data to increase the visibility of the attack and maximize the pressure on the target organization. In many modern cyberattacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not just encrypt the victim's systems to disrupt operations; they also steal sensitive information before the encryption occurs. The threat of leaking this stolen data on a public platform serves as a powerful tool for extortion, as the organization faces both operational downtime and the reputational and legal consequences of a public data exposure.

Details of the alleged exfiltration

The announcement made by the Qilin group alleges the exfiltration of several types of sensitive information. While the group has provided screenshots to support their claims, these images only display blurred samples of various tables and documents, making it impossible to verify the exact contents or the full scope of the breach. The listing specifically names the following types of affected data:

• Personnel data
• Production reports
• Operational data

The presence of such data types in a leak announcement suggests a significant breach of internal information. When sensitive files are moved from a secure corporate environment to an external server controlled by attackers, the integrity and confidentiality of the organization's internal workings are compromised.

About Custom Foods Inc.

The target of this alleged attack is Custom Foods Inc., which operates under the Goodcents brand. Custom Foods Inc. is a food company that produces a variety of frozen dough products, including dough for pizza, bread, and cookies. The company operates affordable food outlets under the Goodcents brand.

Potential impact and security considerations

This incident may pose secondary risks to the organization's employees and operational processes. The allegedly exfiltrated data could be utilized for identity theft or targeted phishing attacks against the individuals whose information was taken. Furthermore, because the organization is based in the United States, legal processes may be triggered under relevant state laws and data protection regulations regarding the handling of sensitive information.

Given that the Qilin group utilizes double-extortion tactics, increased pressure on the organization is likely, which may also impact supply chain security. When a company in the food production and retail sector is compromised, the ripple effects can extend to partners and suppliers who rely on the organization's operational stability and data integrity.

Organizations facing similar threats often prioritize several defensive and reactive steps. Strengthening network segmentation can help prevent attackers from moving laterally from one system to another. Implementing robust monitoring and detection capabilities is essential for identifying unauthorized data exfiltration in real-time. Additionally, maintaining comprehensive backups and ensuring they are isolated from the main network can mitigate the impact of the encryption phase of a ransomware attack. For organizations in the retail and food sectors, protecting the integrity of production and operational data is critical to maintaining consumer trust and ensuring the continuity of the supply chain.