Sperispa.com listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Italy
• Announcement date: September 25, 2025

Qilin ransomware group claims data theft at sperispa.com

The Qilin ransomware group has listed sperispa.com on their dedicated leak site, claiming to have exfiltrated data from the organization. This announcement, made on September 25, 2025, marks a new incident involving the threat actor group as they target specific corporate entities.

The threat actor known as Qilin listed sperispa.com on their leak platform on September 25, 2025. The group claims to have obtained data related to the organization's architectural and infrastructure projects. The announcement includes various visual samples of the organization's activities and threatens the publication of further data if their demands are not met.

Details of the claimed data exfiltration

While the group has published a listing, the specific details regarding the volume of the theft remain unclear. There is no detailed information regarding the full scope or specific types of the exfiltrated data, and no information was provided regarding the total data size, the file count, or the specific ransom demand.

The samples shared in the screenshots appear to contain images related to the organization's architectural projects, infrastructure works, and technical documents. However, the listing does not provide a comprehensive inventory of the stolen files.

About sperispa.com

SPERI SPA is an Italy-based firm providing engineering and consulting services for the architectural environment, buildings, and infrastructure. The company specializes in sustainable management and infrastructure development projects.

Analysis and potential implications

The Qilin group is known to operate using double-extortion tactics, typically targeting sensitive corporate data. In a double-extortion scenario, attackers do not merely encrypt a victim's systems but also steal sensitive information to use as leverage. They threaten to leak this data on public forums or leak sites to pressure the organization into paying a ransom to prevent the exposure of trade secrets and proprietary project details.

This incident may pose a risk of exposing the organization's trade secrets and project details to third parties. Given the group's history, there is a possibility that the data could be publicly released if the ransom demands are not met. Furthermore, because the organization is based in Italy, the breach may trigger data breach notification obligations under the General Data Protection Regulation (GDPR).

In such scenarios, organizations often face secondary risks, such as phishing attacks targeting employees or business partners who may be contacted using the stolen information. To defend against such threats, organizations generally focus on robust data encryption, strict access controls, and comprehensive employee awareness training to recognize social engineering attempts.