Serratelli Hat Listed by Qilin Ransomware Group

On December 9, 2025, Serratelli Hat appeared on the leak site operated by the qilin ransomware group. The company, a well-known manufacturer of hats and headwear, was listed after the attackers claimed to have stolen and exfiltrated internal files during a ransomware incident. Anyone whose personal information was stored in those corporate systems — employees, customers, suppliers, or business partners — may now face increased risk of identity theft and doxxing.

What Public Reporting Shows

Public reporting indicates that qilin posted Serratelli Hat to its data-leak portal on December 9, 2025. The group states it obtained internal company files and is using the leak site to pressure the victim into paying a ransom. Exact victim counts and the full scope of stolen data have not been independently verified, but ransomware operators routinely publish samples that include employee records, customer databases, financial spreadsheets, and operational documents. Available reporting describes the incident as a classic ransomware double-extortion case: encryption of systems followed by threats to release the stolen data.

Why This Matters for You and Your Family

When a company like Serratelli Hat suffers a breach, the information exposed often includes names, addresses, phone numbers, email accounts, dates of birth, and sometimes Social Security numbers or payment details. Internal files can contain exactly the kind of personal data that lets criminals open accounts in your name or target your family members. If you or your children have ever purchased from the company, worked there, or had your information shared with them through a supplier or partner, your details could be among those now circulating among criminals. The breach adds another record to the growing pile of stolen identities that fuel identity theft, phishing campaigns, and harassment for years to come.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company. Criminals frequently cross-reference newly exposed data with records from previous breaches to build detailed profiles. A phone number listed in Serratelli Hat’s supplier contacts, for example, can be linked to your email address from an earlier breach, then to your children’s usernames on gaming platforms. These identity chains let attackers move from simple credential theft to full doxxing — publishing home addresses, family photos, and personal relationships. Credential leaks like this one cascade into account takeovers on email, banking, and especially gaming services where children often reuse passwords or security questions derived from family information.