Qilin ransomware group lists insoca.es on leak site

• Ransomware group: Qilin
• Country: Spain
• Sector: Manufacturing
• Announcement date: August 20, 2025

Qilin ransomware group claims data breach at insoca.es

The Qilin ransomware group has listed the Spain-based manufacturing firm insoca.es on its leak site, claiming to have exfiltrated corporate data. This announcement, made on August 20, 2025, marks a new instance of the group targeting industrial entities to exert pressure through data exposure.

According to the claims made by the Qilin group, the attackers gained unauthorized access to the organization's systems. The group alleges that they have successfully obtained various corporate documents during the intrusion. To support their claims of a successful breach, the group has shared sample documents related to the organization's operations on their leak site.

The samples provided in the announcement include several types of sensitive information. Specifically, the leaked documents include:

• Invoice information
• Corporate reports
• Order details
• Technical maintenance documents

Among the specific items identified in the samples is a gas bill issued by DISA ENERGY S.L.U. to Cartonajes Izquierdo S.A., which further illustrates the nature of the documentation accessed by the threat actors.

About Cartonajes Izquierdo S.A.

Cartonajes Izquierdo S.A., operating under the name Insoca, is a family-owned business located in Spain. The company specializes in the production of corrugated cardboard packaging solutions. Utilizing advanced technology, the firm develops cardboard boxes and various packaging products designed for a wide range of industries.

Risk assessment and implications of the incident

This incident presents a significant risk that sensitive corporate data within insoca.es may have been compromised by third parties. Because the organization operates within Spain, the firm could face legal sanctions under the European Union's General Data Protection Regulation (GDPR) due to potential data security breaches. The exposure of corporate reports and order details can provide intelligence value to competitors or other malicious actors.

The Qilin group's use of double extortion tactics is a notable concern. Double extortion is a method where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten its public release. This tactic increases the pressure on organizations, as the threat of a leak can be used as leverage even if the victim has backups to restore their systems.

The leaked information could be utilized for targeted phishing attacks or supply chain attacks in the future. When attackers obtain technical maintenance documents or order details, they gain insights into the operational workflows of a company, which can be exploited to launch more sophisticated social engineering campaigns against employees or business partners.

The group's past activities indicate that similar attacks could negatively impact financial and operational continuity for targeted organizations. For companies in the manufacturing sector, maintaining robust cybersecurity frameworks is essential to protect commercial information and ensure the uninterrupted flow of production and logistics.

In general, organizations facing such threats often focus on defensive strategies such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access and subsequent data exfiltration.