Qilin ransomware group lists govonisabbiatrici on its leak site

• Ransomware group: Qilin
• Country: Italy
• Sector: Manufacturing
• Announcement date: April 16, 2025

Qilin ransomware group claims attack on govonisabbiatrici

The Italy-based manufacturing company govonisabbiatrici has been listed on the leak site of the Qilin ransomware group. According to an announcement published on the group's leak site on April 16, 2025, the threat actor claims to have conducted a cyberattack against the company's systems.

The group alleges that the incident occurred on February 7, 2025. Through this announcement, the group claims to have obtained the company's data. This type of public listing is a common tactic used by ransomware groups to pressure victims into meeting ransom demands by threatening to release sensitive information to the public.

Details regarding the alleged data breach

Regarding the specifics of the incident, the group has not provided details concerning the nature of the allegedly leaked data. Furthermore, no specific information was provided regarding the amount of data or the total file count involved in the incident. The ransom demand has also not been disclosed in the announcement.

The content of the leak cannot be verified at this time, as the screenshot provided by the group is blurred. Consequently, the listing names no specific data types that have been compromised.

About govonisabbiatrici

Govoni S.r.l. is an Italian company that designs and manufactures sandblasting machines and systems, dust extraction systems, and conveying devices for metal abrasives and silica sands. Additionally, the company specializes in soundproof systems and recovery devices for large cabins.

Risk assessment and industry implications

As the Qilin group is known for employing double-extortion tactics, there may be a risk that the company's sensitive data has been compromised. In a double-extortion scenario, attackers not only encrypt a victim's systems but also steal sensitive data, threatening to leak it if the ransom is not paid. This approach increases the pressure on organizations to comply with demands.

Given that the firm is based in Italy, the incident may trigger data breach notification obligations under GDPR. The claim against the company's manufacturing systems and trade secrets could potentially impact operational continuity and increase supply chain risks. If the leaked data includes employee or customer information, it may lead to identity theft or targeted phishing attacks.

For organizations operating in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures often include maintaining offline backups, implementing strict access controls, and conducting regular security audits to protect intellectual property and operational technology. Protecting against supply chain risks is also critical, as a breach in one manufacturer can potentially impact the broader network of partners and customers.