Tupi listed on qilin ransomware leak site

• Ransomware group: qilin
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: December 9, 2025

The agricultural and food production company Tupi has been listed on the leak site associated with the qilin ransomware group. According to an announcement made on December 9, 2025, the threat actor known as qilin claims to have successfully breached the organization's networks and obtained data belonging to the company.

The claims made by qilin

The threat actor known as qilin alleges that they have gained unauthorized access to the networks of Tupi. Following this access, the group claims to have obtained data belonging to the organization. This announcement was officially posted on the group's leak site on December 9, 2025, the same date the group claims the attack occurred.

Ransomware leak sites serve as a platform for cybercriminals to pressure victims into paying ransoms by threatening to release stolen information. In such scenarios, the threat actor typically claims to have exfiltrated sensitive data during the initial stages of the intrusion. By publishing a victim's name on these sites, the group aims to increase the visibility of the breach to cause reputational and operational damage.

Details regarding the leaked data

At this time, there is no information regarding the specific nature or content of the leaked data. The announcement and the associated screenshots do not provide further details concerning what was taken during the alleged breach.

The listing names no specific data types or file counts at this time.

Organization profile

Tupi S.A. is an agricultural and food production company based in Paraguay. The organization operates primarily in the processing and trading of agricultural products.

Risk assessment and implications

This incident may pose significant risks to the organization's business operations and its overall operational continuity. Given that the qilin group is known to employ a double extortion method, there is a possibility that the organization's sensitive data could be publicly disclosed or sold to third parties. Double extortion is a tactic where attackers not only encrypt a victim's systems but also steal sensitive information, threatening to leak it if the ransom is not paid.

For organizations operating in Brazil, such as Tupi, legal obligations and administrative sanctions under the LGPD (General Data Protection Law) may arise following a data breach. Furthermore, there is a possibility that any leaked data could be utilized by malicious actors for identity theft or to conduct targeted phishing attacks against the organization's employees or customers.

While information regarding the qilin group remains limited, their past activities suggest that organizations should carefully review their data security processes. To mitigate such risks, organizations often implement defensive measures such as robust network segmentation, regular security audits, and comprehensive employee training to recognize phishing attempts. Maintaining strict access controls and monitoring network traffic for unusual activity are also standard practices for defending against the types of intrusions claimed by ransomware groups.