Mastelli S.r.l. Data Breach

Qilin ransomware claimed Mastelli S.r.l., an Italian pharmaceutical and cosmetics manufacturer, on October 18, 2026. Mastelli specializes in aesthetic medicine, dermatology, and biorevitalization products, including injectables and dermal fillers, distributed globally to medical and aesthetic professionals. The potential data at risk includes proprietary formulation data, clinical documentation, sensitive internal business records, and distributor relationships, all of which carry significant competitive and regulatory implications. Qilin has been highly active, claiming approximately 198 victims in the past 60 days, positioning it as one of the most prolific ransomware groups. Its primary targets include the United States, the United Kingdom, and Spain, with a focus on the Manufacturing, Technology, and Professional Services sectors. European manufacturing companies are consistently targeted, and Mastelli aligns with this pattern.

SOCRadar’s stealer-log intelligence identified records associated with Mastelli S.r.l.’s domain. This included two employee credentials linked directly to the organization’s internal systems, categorized as Category A exposure. Additionally, six records were found associated with customer or external parties on platforms affiliated with Mastelli, classified as Category B/C exposure. In total, eight records were discovered across both internal and customer-facing systems. The Category A records represent a more direct risk, as they could have provided Qilin operators with immediate access to critical manufacturing and business systems prior to the ransomware deployment. The six external records suggest that customer and partner account data was also compromised. The exposure of employee credentials on Mastelli’s own systems may have facilitated initial access for the Qilin threat actors. The additional compromised credentials related to external parties and customers indicate a broader scope of data exfiltration, potentially impacting business partners and customer relationships. Response Priorities: Rotate internal employee credentials immediately and review authentication logs for any unauthorized access to product formulation systems, regulatory submission databases, and distributor management platforms. The six compromised customer and partner credential records require individual account-level investigation, and affected parties should be prompted to reset their credentials. Mastelli may face notification obligations under various regulations, including GDPR, potentially the EU Medical Device Regulation, and AIFA requirements, especially if regulatory submission systems were accessed. The dual nature of this exposure, encompassing both internal employee accounts and external customer/partner accounts, necessitates a comprehensive response that extends beyond standard credential rotation procedures.