DelCampo Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 21, 2025, the ransomware group qilin listed DelCampo on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. The number of people affected is unknown, and public information about the scale, timing, and precise method of the incident remains limited.

DelCampo operates as a third-generation, family-owned agricultural business producing fruits and vegetables. Any exposure of internal files in this sector can carry practical consequences for the organisation and for individuals whose details may appear in those records, even when the full contents have not been confirmed.

Inside the incident

Public reporting on the matter is sparse and centres on the listing itself. According to available details, qilin claimed to have carried out a ransomware attack against DelCampo that involved the exfiltration of internal files. The date associated with the public report is June 21, 2025. No confirmed figures have been released for the volume of data taken, the number of systems affected, or the exact window in which the intrusion occurred. The number of people potentially affected is listed as unknown. Method of initial access, duration of presence inside the network, and whether encryption of systems also took place have not been disclosed in the available record. The listing on the group’s leak site therefore stands as an unverified claim rather than an independently confirmed account of the full event.

The group behind it: qilin

Qilin is a ransomware operation that has been publicly documented as functioning on a ransomware-as-a-service model. Groups of this type typically recruit affiliates who conduct the intrusions, then share proceeds from any payments. Established public reporting describes qilin’s usual pattern as double extortion: data is copied out of the victim environment before or during encryption, after which the operators threaten to publish the material on a dedicated leak site if a ransom is not paid. The group has been observed posting victim names and sample files on such sites as a pressure tactic. Prior activity attributed to qilin in open sources has involved organisations across multiple industries rather than a single narrow sector. In the present case, the only specific assertion tied to DelCampo is the group’s own listing claiming that internal files were exfiltrated; no further statements from the group about this particular victim appear in the available facts.

DelCampo and its sector

DelCampo is described as a third-generation, family-owned business dedicated to growing fruits and vegetables year-round. It operates as a vertically integrated enterprise with greenhouses located in Sinaloa and Jalisco, Mexico. Organisations of this kind sit within the agricultural and fresh-produce supply chain. They typically manage cultivation, packing, logistics, and distribution of perishable goods. Because the business is family-owned and multi-generational, its records often combine operational data with long-standing employee, contractor, and supplier information. A ransomware incident that reaches internal files can therefore affect both day-to-day production continuity and the personal or commercial details of people connected to the company. In the broader food-production sector, such events also raise questions about supply-chain resilience, though no public confirmation exists that production itself was halted in this instance.

What data was at risk

The only data type named in the available record is “internal files” said to have been exfiltrated during the ransomware attack. Exact file names, categories, or volumes have not been disclosed. For an agricultural producer of DelCampo’s profile, internal files commonly include employee personnel records, payroll information, supplier contracts, shipping and inventory logs, greenhouse operational data, financial documents, and correspondence. Whether any of those categories were among the material taken remains unconfirmed. Because the number of people affected is listed as unknown and no sample data has been publicly detailed in the facts provided, it is not possible to state with certainty which specific personal or commercial records, if any, left the organisation’s control.

What's at stake

For individuals whose information may have been present in the exfiltrated files, the concrete risks include potential misuse of personal identifiers, contact details, or employment-related data should those records later appear in secondary markets or phishing campaigns. Financial or identity-related harm is possible if sensitive fields such as identification numbers or banking references were included, though that inclusion has not been verified. For DelCampo itself, the stakes centre on operational continuity, the cost of investigation and recovery, possible regulatory notification duties, and reputational effects among suppliers and customers. Because the business handles perishable produce through a vertically integrated chain, any prolonged disruption to systems that manage logistics or quality control could affect deliveries, yet no public confirmation of such disruption has been reported. The absence of confirmed victim counts and data inventories means the precise human and organisational impact cannot yet be measured.

If your data was in this claimed breach

If you have a past or present connection to DelCampo—as an employee, contractor, supplier, or other party—and believe your information could have been among the internal files, begin with basic protective steps. Monitor financial accounts and credit reports for unfamiliar activity. Change passwords on any accounts that reused credentials potentially stored in company systems, and enable multi-factor authentication where available. Be alert to unexpected messages that reference the company or request personal confirmation. Because the exact contents of the exfiltrated material remain unconfirmed, treat any subsequent contact claiming to possess your data with caution. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan provides an additional, independent signal of prior exposure even when details of this specific incident stay limited.

AICompiled with AI assistance from public sources and published under our editorial standards.