SUSTA S.r.l. Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers across Europe, often listing victims on leak sites after claiming to have stolen internal files. In this landscape, the appearance of an Italian tooling firm on a ransomware group's site is a familiar pattern: limited public confirmation, pressure on the organisation, and uncertainty for anyone whose data might be involved.

On 18 November 2024, SUSTA S.r.l. was listed by the dragonforce ransomware group. Public detail is limited. The listing claims that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and no independent confirmation of the full scope has been published.

What happened

According to the available record, SUSTA S.r.l. was listed by the dragonforce ransomware group on 18 November 2024. The group claims that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public facts. The number of individuals potentially affected is listed as unknown. As with many such listings, the claim originates from the threat actor’s own site and has not been independently verified in the material provided.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has been publicly documented for using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups in this category, it maintains a leak site where it posts victim names and, in some cases, samples of stolen material to increase pressure. Public reporting has associated dragonforce with attacks on organisations of varying sizes, often in manufacturing, logistics and professional services. The group typically claims responsibility through its own channels rather than through independent verification. In this instance, the listing of SUSTA S.r.l. should be treated as the group’s claim; the facts do not state that the claim has been confirmed by the company or by law-enforcement sources.

SUSTA S.r.l. and its sector

SUSTA S.r.l. is an Italian company that began designing and building moulds for automotive components in 1992. Public descriptions of the firm emphasise its focus on tooling for the auto-parts sector, the selection and management of specialised teams, organised workflows, and ongoing updates to skills and technology. Companies of this type sit in the supply chain that supports vehicle manufacturers and tier-one suppliers. They typically hold engineering drawings, production schedules, supplier and customer contacts, employee records, and commercial contracts. A breach at such an organisation can therefore affect not only the firm itself but also partners and individuals whose details appear in those internal systems. Because the automotive tooling sector relies on precise technical data and long-standing commercial relationships, unauthorised access to internal files carries both operational and privacy consequences.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No more specific inventory—such as employee personal data, customer lists, financial records, or design files—has been named. Organisations that design and manufacture automotive moulds commonly store technical drawings, CAD data, quality documentation, purchase orders, invoices, and personnel information. Whether any of those categories were among the files claimed by dragonforce is unconfirmed. Public detail on the exact contents remains limited, and no verified list of exposed data types beyond “internal files” has been provided.

What's at stake

For individuals whose information may have been present in the exfiltrated files, the practical risks include possible misuse of contact details, identity-related fraud if personal identifiers were held, or targeted phishing that references genuine business relationships. For the organisation, the stakes include potential disruption of production planning, exposure of proprietary tooling know-how, and the need to notify partners and regulators where required by law. Because the scale of the incident and the precise data types remain undisclosed, the full extent of these risks cannot yet be measured. The listing itself can also create reputational pressure and force the company to divert resources to investigation and response, regardless of whether a ransom is paid.

If your data was in this claimed breach

If you have had dealings with SUSTA S.r.l.—as an employee, supplier, customer or contractor—treat the possibility of exposure seriously even though the number of people affected is unknown. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be cautious of unsolicited messages that reference the company or the automotive sector. Consider changing passwords that may have been reused across work and personal services. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If you believe your data was involved, document any suspicious contacts and, where appropriate, report them to local authorities or the relevant data-protection authority.

AICompiled with AI assistance from public sources and published under our editorial standards.