SUSTA-STAMPI Listed by qilin Ransomware Group

On November 18, 2024, Italian manufacturing firm Susta Srl appeared on the leak site operated by the qilin ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which is based in Castellalto, Abruzzo, and employs 20 to 49 people. Anyone whose personal or employment records were stored in those systems may now face long-term exposure.

Details from the Leak Site

The qilin leak site entry states that Susta Srl suffered a ransomware intrusion and that attackers successfully removed internal files. The disclosure does not specify the exact number of records involved, the precise data types beyond “internal files,” or any ransom amount demanded. It simply lists the company as a victim and provides a partial sample of the allegedly stolen material. The notification makes clear that the data was taken before any encryption occurred on the victim’s systems, a standard qilin tactic.

Why This Matters for You and Your Family

Even a small manufacturer like Susta Srl handles employee names, addresses, tax identifiers, payroll details, and supplier contracts. If you or a family member ever worked there, had business with the company, or had personal information stored in its systems, that information may now be in the hands of criminals. Internal files exfiltrated in November 2024 can be sold, published, or used as leverage in future scams. For ordinary families this means higher risks of identity theft, fraudulent loan applications, or targeted phishing that references real employment history.

The Doxxing and Identity-Chain Risks

Stolen internal files often contain spreadsheets that link employee emails, phone numbers, dates of birth, and sometimes family contact details. Attackers can combine this information with data from previous breaches to build complete identity chains. A single leaked work email can lead to personal accounts, children’s gaming profiles, and home addresses. These chains accelerate doxxing because one confirmed fact makes every subsequent social-engineering attempt more convincing. Credential leaks of this nature frequently cascade into account takeovers on gaming platforms, where children’s usernames and shared family passwords become entry points for further harassment or extortion.

Qilin’s Known Track Record

Public reporting attributes the emergence of the qilin ransomware group to mid-2022. The gang has since hit dozens of organizations across Europe and North America, with notable prior victims including healthcare providers, logistics firms, and small-to-medium manufacturers. Their typical playbook begins with phishing or stolen credentials for initial access, followed by rapid lateral movement, data exfiltration, and then dual extortion: demanding payment both to prevent file publication and to receive a decryptor. The group routinely posts victim data on its dark-web leak site when negotiations fail or deadlines pass, using the exposure itself as pressure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you ever used at Susta Srl or related business systems, then enable 2FA through an authenticator app everywhere that password was reused.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same leaked address or email.
• Let remediation specialists manage takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The Susta Srl incident shows how even modest manufacturers can become gateways to personal exposure for ordinary families. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks like this one.