Stormous ransomware group lists rinaldi.com.br on its leak site

• Ransomware group: Stormous
• Country: Brazil
• Sector: Professional Services
• Announcement date: June 6, 2025

Stormous claims to have stolen data from rinaldi.com.br

The threat actor known as Stormous has listed rinaldi.com.br on its leak site, claiming to have obtained the organization's data. This announcement, which was made on June 6, 2025, suggests that the group has successfully executed a cyberattack against the Brazilian entity. According to the claims made by the group, they currently have approximately 1 GB of data in their possession.

Stormous is a group that has been active since 2021. The group characterizes its operations as being politically motivated, which distinguishes its objectives from purely financially driven ransomware actors. In many such cases, threat actors utilize double extortion tactics, where they not only encrypt an organization's systems but also threaten to release sensitive information on a public leak site to increase pressure on the victim to meet their demands.

Details of the alleged data leak

The announcement made by the group claims that the stolen information includes a wide variety of sensitive data points. The group asserts that the breach involves information related to a significant number of business partners and internal personnel. Specifically, the claim includes information on 1,000 registered distributors and sellers, as well as various other categories of data. The specific types of data mentioned in the claim include:

• Employee data
• Customer data
• Distributor information
• Seller information
• Admin credentials
• Email addresses
• Phone numbers

While the group has made these claims, the provided screenshot associated with the announcement shows a technical error page from the leak site, rather than the data itself. No information was provided regarding a ransom demand.

About rinaldi.com.br

Rinaldi is a Brazilian company that specializes in the manufacturing of tires and inner tubes for motorcycles and agricultural vehicles. Founded in 1969, the company has established itself as a significant player in the industry, maintaining an extensive distribution network that serves both domestic and international markets.

Potential risks and implications

The alleged data leak could pose significant secondary risks to the organization and its stakeholders. The exposure of employee and customer data can lead to identity theft or targeted phishing attacks directed at the individuals involved. Furthermore, the claim regarding the exposure of administrative passwords significantly increases the risk of unauthorized access to the institution's internal systems, which could lead to further compromises.

Because the institution operates in Brazil, this incident may lead to legal and administrative consequences under the LGPD (General Data Protection Law). Given the politically motivated nature of the Stormous group, it is possible that such leaks are intended to damage the reputation of the institution. The group's past activities suggest that they often use data leaks as a tool for pressure.

In general, organizations facing such threats can benefit from implementing robust defensive measures. These include maintaining regular, offline backups, implementing multi-factor authentication to protect administrative credentials, and conducting regular security awareness training to help employees recognize phishing attempts. Monitoring for unauthorized access and ensuring compliance with regional data protection regulations are also critical components of a modern cybersecurity posture.