VM Racing targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: July 14, 2025

Qilin claims breach of VM Racing

The Qilin ransomware group has announced that it has successfully breached the systems of VM Racing, an Italian retail company. According to the group's announcement on their leak site, the attackers claim to have exfiltrated a significant volume of data from the organization's infrastructure. This announcement serves as a method of pressure, a common tactic used by ransomware operators to coerce victims into meeting their demands.

The incident, which was publicly listed by the group on July 14, 2025, is claimed to have occurred on July 13, 2025. The group asserts that they have gained unauthorized access to the company's internal systems and have successfully extracted a massive dataset. This type of public listing is a hallmark of modern ransomware operations, where the threat of data exposure is used as a primary lever in negotiations.

Details of the alleged data theft

The Qilin group claims to have stolen a total of 83 GB of data. This dataset is reported to consist of 1,041,539 individual files. The group has provided evidence in the form of screenshots, which appear to display various file directories and samples from databases, intended to validate their claims of unauthorized access and data exfiltration.

The information allegedly stolen during this breach includes a variety of sensitive categories. Based on the group's claims, the affected data types include:

• Customer information
• Passwords
• Phone numbers
• Personal data
• Administrative documents

The presence of such diverse data types, ranging from individual contact details to internal administrative files, suggests a broad compromise of the organization's digital environment.

About VM Racing

VM Racing is an Italian retail company that operates within the sports equipment and merchandise sector. The company specializes in the sale of various products, with a primary focus on the motorcycle sector. Their business model involves dealing with a wide range of motorcycle parts and accessories, serving customers within the specialized automotive and sports markets.

Analysis and potential impact

Qilin is recognized as a Ransomware-as-a-Service (RaaS) group that has been active since 2022. The group is known for employing double extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This dual-threat approach significantly increases the pressure on the victim organization.

The potential consequences of this breach are multifaceted. For VM Racing, the incident could lead to significant regulatory scrutiny and consequences under the EU General Data Protection Regulation (GDPR), given the company's location in Italy. Furthermore, the breach poses a threat to the organization's operational continuity and could cause lasting damage to its brand reputation.

For the individuals whose data was allegedly stolen, the risks are direct and personal. The exposure of passwords, phone numbers, and personal information increases the likelihood of victims facing identity theft and targeted phishing attacks. In such scenarios, attackers use stolen credentials and contact details to conduct highly convincing social engineering campaigns.

Given the established modus operandi of the Qilin group, the risk of the stolen data being published on the dark web or sold to other malicious actors remains high. Organizations in the retail and e-commerce sectors can mitigate such risks by implementing robust security frameworks, including multi-factor authentication, regular security audits, and comprehensive data encryption protocols to protect sensitive customer and administrative information.