SUSTA S.r.l. Listed by dragonforce Ransomware Group

SUSTA S.r.l., an Italian automotive component mold designer founded in 1992, was listed on the DragonForce ransomware leak site on November 18, 2024. The extortion group claims to have exfiltrated internal files during a ransomware attack on the company. The leak-site listing does not specify the number of records affected or detail the exact data categories stolen, leaving affected individuals and partners uncertain about their exposure.

Primary Disclosure Details

The DragonForce leak site states that SUSTA S.r.l. suffered a ransomware attack in which internal files were allegedly exfiltrated. No victim count, ransom amount, or precise inventory of stolen data appears in the posting. The disclosure consists primarily of the company name, a brief corporate description, and the announcement that files may now be available for download or public release if demands are not met. Public reporting on similar DragonForce listings indicates this pattern is standard: initial access followed by data theft and public shaming to pressure payment.

Why This Matters for You and Your Family

When a manufacturing supplier like SUSTA is breached, the fallout reaches far beyond the company. Employees, customers in the automotive supply chain, and business partners may have personal or financial details stored in the compromised internal files. If your employer works with automotive manufacturers, or if you or a family member have ever provided employment, banking, or contact information to SUSTA or its partners, those records could now sit in an attacker-controlled archive. Internal files often contain spreadsheets with names, addresses, tax identifiers, salaries, or vendor payment records — information that fuels identity theft and targeted fraud for years.

Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently include email addresses, usernames, and project notes that link corporate identities to personal accounts. Attackers and subsequent data resellers can chain these fragments together: a work email leads to a personal phone number, which leads to a gaming username, which leads to family photos or children’s accounts. This creates persistent doxxing pipelines. Credential leaks of this type routinely cascade into account takeovers on gaming platforms, where children’s profiles become entry points for further harassment or social engineering. The longer the data circulates on dark-web forums, the harder it becomes to contain.

DragonForce’s Known Track Record

Public reporting attributes DragonForce’s emergence to mid-2024. The group has targeted organizations across manufacturing, healthcare, and professional services, typically gaining initial access through phishing or unpatched remote desktop services. After exfiltration, DragonForce follows a double-extortion playbook: encrypting systems where possible and simultaneously threatening to publish stolen data on their leak site. Notable prior victims include mid-sized industrial firms whose internal documents appeared in similar indexed postings. Their style emphasizes rapid publication deadlines and occasional sample leaks to demonstrate seriousness.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you have reused at SUSTA or related automotive vendors, then enable 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts often chained to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal records appearing on data-broker or extortion sites.

The SUSTA listing is a reminder that ransomware groups continue to treat supplier networks as high-value targets whose compromise ripples into thousands of households. Staying ahead requires more than reactive checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real people, and hands-on remediation specialists who handle removal work directly — including protection for your family’s and children’s gaming accounts that so often become the next link in a doxxing chain.