Studio Corvo Parma listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Italy
• Sector: Professional Services
• Announcement date: November 6, 2025

Qilin ransomware group claims attack on Studio Corvo Parma

The threat actor known as Qilin has listed the Italian organization Studio Corvo Parma on its dedicated leak site. In the announcement, the group alleges that it has successfully executed a cyberattack against the firm, resulting in a data breach. This listing serves as a public claim by the ransomware group regarding its recent activities against the professional services provider.

Details of the alleged intrusion

According to the announcement posted on November 6, 2025, the Qilin group claims to have gained unauthorized access to the internal network of Studio Corvo Parma. The threat actors assert that they were able to exfiltrate data from the organization's systems during the course of the intrusion. To support their claims, the group included screenshots of documents that they allege were stolen from the organization's environment.

Regarding the specific nature of the stolen information, the content of the shared screenshots remains blurred. Due to this obfuscation, it is currently impossible to identify the specific data types or the exact nature of the documents that were allegedly taken during the breach. No specific file counts, data sizes, or ransom demands were provided in the announcement.

About Studio Corvo Parma

Studio Corvo is a professional services firm based in Parma, Italy. The organization specializes in the accounting and tax consultancy sector. The company provides a variety of financial services to both businesses and individuals, including financial advisory, tax planning, and corporate consulting services.

Potential risks and industry implications

The situation involving Studio Corvo Parma highlights the ongoing risks associated with double-extortion tactics commonly employed by ransomware groups. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. The threat actors threaten to publish or sell the stolen data on the internet if a ransom is not paid, creating significant pressure on the victimized organization.

Because Studio Corvo Parma is based in Italy, this incident carries potential legal and administrative implications under the European Union's General Data Protection Regulation (GDPR). A confirmed breach involving personal information could trigger regulatory scrutiny and significant penalties. Furthermore, the exposure of client or employee information poses a direct risk to the individuals involved, as it may lead to identity theft and targeted phishing attacks designed to exploit the leaked details.

The group's historical patterns suggest that if ransom demands are not met, the stolen data may be made public. Such an outcome can lead to severe negative impacts on an organization's operational continuity and reputation. For organizations operating within the professional services sector, maintaining robust security postures is critical. Common defensive strategies often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of unauthorized network access and data exfiltration.