Lipapromet Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 6 October 2025, the Croatian company Lipapromet was listed by the ransomware group known as qilin. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed.

The listing itself is a claim made by the group on its leak site. For a firm that supplies LED lighting solutions, any confirmed exposure of internal material carries practical consequences for business operations, partners and individuals whose details may appear in those files. Exact contents and scale are still unconfirmed.

What happened

Public records show that Lipapromet was named on a qilin leak site on 6 October 2025. The available summary states that internal files were exfiltrated in a ransomware attack. No confirmed timeline for the intrusion, no technical description of the initial access method, and no verified figure for the volume of data taken have been released. The number of individuals potentially affected is listed as unknown. Beyond the group’s claim that the company was compromised and that internal files left its systems, independent confirmation of the full scope remains limited.

Inside qilin

qilin is a ransomware operation that has been active for several years and is widely documented as running a ransomware-as-a-service model. Affiliates typically gain access to a target network, move laterally, and then both encrypt systems and exfiltrate data before issuing ransom demands. The group’s public leak sites are used to pressure victims by threatening or carrying out the publication of stolen material if payment is not made. Prior campaigns attributed to qilin have targeted organisations across multiple sectors and countries, often focusing on mid-sized firms whose operational data or customer records can be leveraged for double extortion. In this case, the only specific assertion tied to Lipapromet is the group’s own listing; no additional claims about the victim’s systems or negotiations have been independently verified in the public record.

Who is Lipapromet?

Lipapromet is a Croatian company founded in Zagreb in 1990. It specialises in LED lighting solutions, supplying products and related services that support commercial, industrial and public-sector lighting projects. Like many firms of this type, it maintains supplier contracts, project documentation, employee records, financial data and customer or partner contact information. Public financial summaries note that the company’s annual revenue in 2024 was reported as €31,728,95, though fuller audited figures are not detailed in the breach-related material. A ransomware incident at such an organisation is consequential because lighting-supply businesses often hold technical drawings, pricing agreements and personal data belonging to staff and clients; disruption or exposure can affect ongoing projects, contractual relationships and the privacy of individuals connected to the firm.

What was likely exposed

The only data category named in public reporting is “internal files” said to have been exfiltrated. No inventory of specific file types, no sample documents and no confirmation of whether customer lists, employee records, financial statements or technical designs were among them has been released. Organisations that design and sell LED lighting systems typically store project specifications, supplier invoices, payroll information, email correspondence and client contact details. Because the precise contents remain undisclosed, it is not possible to state as fact which of these categories, if any, left the company’s control. Readers should treat any later claims of particular data sets as unverified until independent evidence appears.

The real-world impact

For individuals whose information may appear in the stolen files, the principal risks are opportunistic misuse of contact details, phishing attempts that reference genuine project or employment information, and, in rarer cases, identity-related fraud if personal identifiers were present. For Lipapromet itself, the immediate operational impact of a ransomware event can include temporary loss of access to systems, interruption of order fulfilment and the cost of forensic investigation and recovery. Longer-term effects may involve contractual notifications to partners, potential regulatory scrutiny under European data-protection rules, and reputational questions from customers who rely on the firm for lighting infrastructure. Because the scale of the exfiltration and the exact data types remain unconfirmed, the severity of these risks cannot yet be quantified with precision.

Were you affected?

If you have worked with, supplied or been employed by Lipapromet, monitor financial and email accounts for unusual activity and treat unsolicited messages that reference the company with caution. Change passwords on any accounts that may have been reused in a business context and enable multi-factor authentication where available. Because the number of people affected is still unknown, a practical next step is to run a free exposure scan of your email address against known breach data sets; this can indicate whether your details have already appeared in public dumps, even if they are unrelated to this particular incident. Official statements from the company or Croatian authorities, when issued, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.