Qilin ransomware group lists https://www.injusa.com/ on its leak site

• Ransomware group: Qilin
• Country: Spain
• Sector: Manufacturing
• Announcement date: July 2, 2025

Qilin ransomware group claims attack on Injusa

The Qilin ransomware group has officially listed the Spanish manufacturing company Injusa on its dedicated leak site. According to the announcement made on July 2, 2025, the threat actor group claims to have successfully carried out a ransomware attack against the organization. This listing serves as a public claim by the group that they have gained unauthorized access to the digital assets of the company and have obtained various documents belonging to the entity.

The group's post includes general information regarding the company's operations, which they have paired with screenshots intended to demonstrate the nature of the compromised data. While the group has publicized these images to validate their claims, the full scope and the exact volume of the data they have allegedly stolen remain undisclosed at this time.

Alleged data compromise and contents

The information provided by the Qilin group suggests that the breach involves sensitive business documentation. Based on the screenshots provided in the leak site announcement, the compromised material appears to include various documents essential to the company's commercial and administrative functions. Specifically, the evidence presented points toward the exposure of:

• Invoices
• Administrative documents

It is important to note that while these examples have been shared, there is no detailed information available regarding the full content or the total amount of data that has been accessed by the attackers. The specific quantity of files and the exact nature of all stolen documents have not been provided by the threat group.

About Injusa

Injusa is a well-established family business based in Spain. The company is a significant player in the toy industry, specializing in the manufacturing of various products including ride-on electric vehicles, bicycles, and outdoor toys designed for children. The organization maintains a large-scale production capacity, with an annual output exceeding 850,000 units.

Analysis and potential risks

The Qilin group is recognized for employing double-extortion tactics. This method involves not only encrypting a victim's systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak stolen information on public platforms, the group aims to pressure the organization into paying a ransom. This specific tactic creates several secondary risks for the target organization, its employees, and its various business partners. For instance, the exposure of internal documents can lead to identity theft or facilitate highly targeted phishing attacks against stakeholders.

Furthermore, because Injusa is based in Spain, this incident could potentially lead to significant legal and administrative sanctions under the EU General Data Protection Regulation (GDPR). Beyond the regulatory implications, the disclosure of commercial data and the potential disruption of operational processes may harm the company's competitive position within the manufacturing sector. Given the historical activity patterns of the Qilin group, there is a possibility that the leaked data could be released on a larger scale in the future.

In such scenarios, organizations typically face the challenge of managing both technical recovery and reputational damage. The disclosure of administrative and commercial documents can undermine trust with suppliers and customers. As seen with many ransomware groups, the threat of a data leak remains a potent tool for extortion, making the protection of digital assets a critical priority for manufacturers operating in highly competitive global markets.