Soubeiran Chobet S.R.L. targeted by crypto24 ransomware group

• Ransomware group: crypto24
• Country: Argentina
• Sector: Professional Services
• Announcement date: July 22, 2025

Crypto24 claims data exfiltration from Soubeiran Chobet S.R.L.

The ransomware group known as crypto24 has claimed responsibility for a significant data breach involving the Argentinian pharmaceutical company Soubeiran Chobet S.R.L. According to an announcement made on a leak site on July 22, 2025, the group alleges that they have successfully exfiltrated a vast amount of sensitive information from the organization's internal servers.

The group asserts that the breach occurred around July 14, 2025. While the specific details regarding the ransom demand remain unknown, the threat actor has publicly listed the victim on their leak site, claiming to have obtained a massive volume of data, estimated to be over 300 GB. This type of activity is characteristic of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt systems but also steal sensitive data to use as leverage during negotiations.

Details of the alleged data theft

The scope of the data allegedly stolen by crypto24 is extensive, covering various aspects of the organization's business, technical, and regulatory operations. The group claims to have accessed a wide array of files from the company's internal infrastructure. The information reportedly includes critical business documents such as Microsoft Dynamics GP databases, financial records, and accounting files. Additionally, the leak is said to contain human resources files, inventory logs, and production process documentation.

Beyond standard business administration files, the stolen data reportedly includes highly sensitive technical and regulatory information. This encompasses customer contracts, complaint records, and various datasets related to research and development (R&D) and quality control (QC). The group claims to have obtained:

• Financial records
• Accounting records
• HR files
• Customer contracts
• R&D datasets
• Pharmaceutical formulations
• Regulatory correspondence

The list of allegedly compromised information is further expanded by claims of stolen HPLC/FASE MOVIL outputs, experimental protocols, master batch records, ANMAT/FDA CTDs, product recall logs, GMP audit results, and various regulatory correspondence. No screenshots were provided by the group to verify the contents of the stolen data.

About Soubeiran Chobet S.R.L.

Soubeiran Chobet S.R.L. is a pharmaceutical company based in Argentina. The organization specializes in the development and manufacture of pharmaceutical products and formulations. The company's operational focus is centered on research and development, quality control, and maintaining strict regulatory compliance processes to ensure the safety and efficacy of its products.

Potential impact and industry implications

This incident poses a significant risk to the protection of the organization's trade secrets and intellectual property rights. Given the highly specialized nature of the data allegedly stolen—including pharmaceutical formulations and experimental protocols—the breach could have negative impacts on the organization's production processes and its relationships with regulatory bodies. If the sensitive data is transferred to third parties, the company may face secondary risks such as a loss of competitive advantage and damage to its corporate reputation.

In the pharmaceutical sector, where regulatory compliance and intellectual property are paramount, such breaches can be particularly disruptive. The loss of technical datasets and regulatory correspondence can complicate interactions with authorities like the ANMAT or FDA. Organizations in this sector typically must follow strict regulatory requirements regarding data protection and may need to initiate formal data breach notification processes to comply with legal mandates. General defensive measures for such organizations often include implementing robust access controls, maintaining offline backups, and conducting regular audits of regulatory and research data environments to mitigate the risk of unauthorized exfiltration.