2 Remove Virus

Cressi ransomware attack claimed by Qilin group

A ransomware group has claimed responsibility for a cyberattack on Cressi, an Italian manufacturer of diving and water sports equipment. The claim was published on a dark web leak site operated by Qilin, a ransomware operation that has targeted organisations across multiple sectors.

 

 

The group listed Cressi as a victim and alleged that internal data had been compromised. As of the time of reporting, no sample data had been published, and the attackers had not disclosed details about the scope or type of information they claim to have obtained. Such listings are commonly used by ransomware groups to pressure organisations into negotiations by threatening public data release.

Cressi is a long-established manufacturer of scuba diving, freediving, snorkelling, spearfishing, and swimming equipment. Founded in 1946, the company is based in Genoa and distributes its products globally through a network of partners and retailers. There has been no public statement from Cressi confirming or denying the ransomware claim, and the company did not respond to requests for comment cited in the original report.

Qilin has been active since at least 2022 and is known for operating a leak site where it publishes the names of organisations it claims to have breached. Security researchers have previously linked the group to attacks on manufacturing companies and healthcare providers. In past cases, Qilin has followed initial listings with the release of data if ransom demands were not met, although outcomes vary by incident.

At present, there is no independent confirmation that Cressi systems were encrypted or that customer, employee, or business data was accessed. Without verification from the company or supporting evidence from the attackers, the impact of the alleged incident remains unclear.

The situation reflects ongoing ransomware activity targeting manufacturing firms, where attackers seek to exploit operational disruption and data exposure risks. Further information is expected if either the company issues a statement or the attackers publish additional material.