SUSTA-STAMPI Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers across Europe, using double-extortion tactics that combine encryption with the threat of public data leaks. In this environment, even smaller industrial firms can appear on criminal leak sites, raising questions for employees, partners and customers about what may have been taken and how far the exposure reaches.

On 18 November 2024, the ransomware group known as qilin listed SUSTA-STAMPI on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. The number of people affected remains unknown, and public detail about the precise scope and method is limited. The listing itself is a claim by the group; independent confirmation of the full extent of the incident has not been publicly established.

Inside the incident

According to the available record, SUSTA-STAMPI was listed by the qilin ransomware group on 18 November 2024. The group asserts that internal files were exfiltrated during a ransomware attack. No figure for the number of individuals affected has been disclosed, nor have technical details of the intrusion method, the duration of access, or the exact volume of data been made public. Timing beyond the reported listing date is also undisclosed. In short, the public picture rests on the group’s claim of a successful ransomware operation that included data theft, without further verified metrics.

Because the facts do not describe any ransom demand, negotiation, or subsequent publication of sample files, those elements remain outside the claimed record. The incident is therefore best understood as a claimed ransomware event involving the exfiltration of internal company files, reported through the group’s leak-site listing.

Inside qilin

Qilin is a well-documented ransomware operation that functions as a ransomware-as-a-service (RaaS) offering. Affiliates typically gain initial access through phishing, compromised credentials or exposed remote services, then deploy encryptors while simultaneously copying data for leverage. The group is known for double-extortion practices: encrypting systems and threatening to publish stolen material on a dedicated leak site if payment is not made. Public reporting has associated qilin with attacks on organisations across multiple sectors and regions, often mid-market firms whose operational data and internal documents can be used as pressure points.

In the present case, the only specific claim tied to SUSTA-STAMPI is the leak-site listing itself and the assertion that internal files were taken. No additional statements by the group about this victim—such as file counts, ransom amounts or sample releases—are part of the provided facts, and none are invented here. The listing should therefore be treated as an unverified claim pending further independent corroboration.

Who is SUSTA-STAMPI?

SUSTA-STAMPI, also identified as Susta Srl, is a manufacturing company headquartered in Castellalto, Abruzzo, Italy. Public information places its workforce in the range of 20 to 49 employees and its annual revenue between €5 million and €10 million. Firms of this size and sector typically design, produce or supply industrial components, tooling or specialised parts, and maintain relationships with suppliers, customers and logistics partners across regional and sometimes international supply chains.

A ransomware incident at such an organisation is consequential because manufacturing operations rely on continuous access to production schedules, technical drawings, quality records and commercial contracts. Disruption or exposure can affect not only the company itself but also the smaller ecosystem of partners who depend on timely deliveries and confidential technical information. The limited public footprint of a mid-sized Italian manufacturer does not reduce the practical impact of a data-theft claim; it simply means fewer external observers may notice until the listing appears.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, categories or volumes has been disclosed. Organisations in the manufacturing sector commonly hold technical drawings, production data, supplier and customer lists, employee records, financial documents and quality-control materials. Whether any of those categories were among the files taken remains unconfirmed. Exact contents are therefore unknown; only the general characterisation “internal files” is on record.

Readers should treat any more specific description of the stolen material as speculative until additional verified information becomes available. The absence of a public inventory does not mean the exposure is trivial; it means the precise risk profile cannot yet be mapped from open sources alone.

What's at stake

For individuals whose personal or professional data may have been among the internal files, the concrete risks include potential misuse of contact details, identity information or employment records for phishing, social engineering or fraud. Employees and contractors could face targeted messages that appear legitimate because they reference real company context. Partners and customers whose commercial or technical information was stored on the company’s systems may confront competitive or contractual exposure if that material is later published or sold.

For the organisation, the stakes include operational disruption from encryption, reputational damage from the public listing, possible regulatory scrutiny under European data-protection rules, and the cost of investigation, remediation and customer notification. Because the number of people affected is unknown, the full scale of downstream harm cannot be quantified from the present record. The risk is real but currently bounded by the limited public detail.

If your data was in this claimed breach

If you have a past or present relationship with SUSTA-STAMPI—as an employee, contractor, supplier or customer—treat the possibility of exposure seriously even while exact contents remain unconfirmed. Change passwords associated with any company accounts, enable multi-factor authentication where available, and watch for unexpected emails or calls that reference the firm. Monitor financial and credit activity for unusual behaviour. Keep records of any suspicious contact so that patterns can be reported to the company or to relevant authorities if needed.

You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Such a check will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant the same protective steps. Stay alert for official updates from the company; until more detail is released, cautious hygiene remains the most practical response.

AICompiled with AI assistance from public sources and published under our editorial standards.