Euroflora srl Data Breach

Euroflora srl, an agriculture and food production company based in Italy, was identified on the Qilin ransomware group’s leak site on August 23, 2026. The company operates within Italy’s horticultural and agricultural products market. This listing occurs amidst a period where Qilin has increased its targeting of Italian companies across various sectors. Over the preceding 60 days, Qilin ransomware claimed approximately 210 victims, with Manufacturing, Professional Services, and Other industries being the most frequently targeted. The United States, Germany, and Italy represent the top victim countries. The prevalence of Italian victims, including Aurore Development S.p.A., Studio BOLDRIN PAOLO, Tecnici Associati STP, and S.E.M.P. s.r.l., is consistent with Euroflora srl’s listing. While the agricultural sector is not typically a primary focus for Qilin, this incident highlights the group’s expanding reach and opportunistic targeting of less common industries.

Initial access correlation against SOCRadar’s stealer-log telemetry returned no records for the domain www.euroflorasrl.it within the queried data slice. It is important to note that a null result does not definitively confirm the organization is unaffected. The queried sample was paginated, and credentials may exist under alternate corporate domains or be associated with personal email aliases, both of which fall outside the scope of this particular query. Additionally, any discovered credentials may have been used and subsequently rotated before being indexed in the dataset, meaning their absence in this specific query does not rule out past compromise. Infostealer-harvested credentials are a primary initial access vector for ransomware groups operating at scale. While no direct stealer-log evidence was surfaced for Euroflora srl’s domain in this query, the absence of findings in a limited sample should not be interpreted as a confirmation of clean security posture. Qilin’s operational patterns are known to involve phishing, exploitation of exposed VPN appliances, and the use of recycled credentials for initial access. Affected organizations are strongly advised to conduct thorough audits of their authentication logs, enforce multi-factor authentication (MFA) on all internet-exposed services, and treat any listing on a ransomware leak site as a significant indicator that the threat actor has gathered substantial operational intelligence about their target. Continued monitoring of the dark web and stealer-log feeds, alongside proactive credential hygiene practices, is recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.