The Qilin ransomware group has published on its dark web portal the alleged data leak from the Ahorramas supermarket chain. The cybercriminals claim to have accessed sensitive internal documentation after an attack that combines information theft with the threat of public exposure.
The criminal group claims to possess the company's ID cards, financial records, and store blueprints. This action is part of a double extortion strategy designed to pressure victims through the disclosure of corporate secrets and personal data.
The company confirms the incident and denies customer impact
Ahorramas recognized through an official statement the detection of a cybersecurity incident last week. The internal security teams activated the planned response protocols and maintain operations normally at all times according to the corporate version.
The company's management has filed the corresponding complaint with the State Security Forces and Corps. It also notified the incident to the National Cybersecurity Institute (INCIBE) and the Spanish Data Protection Agency (AEPD) to comply with current regulations.
"According to our preliminary analysis, the data that may have been compromised are from our employees" - Ahorramas, Official statement
The organization informs that it has alerted all affected workers without undue delay. However, it maintains the technical investigation open to determine the exact scope of the breach and reinforce security controls against future attempts.
A hyperactive gang with hundreds of recent victims
Qilin operates since July 2022 under various denominations and is linked to the Russian-speaking ecosystem. In 2025 it surpassed 700 ransomware attacks, consolidating itself as one of the most active criminal structures after the disappearance of RansomHub.
The group's history includes previous attacks on Spanish entities such as the insurer Asefa or the Chamber of Commerce of Ávila. The Hackmanac platform catalogs this new incident with an ESIX level of 5.40 due to the sensitivity of the exposed information.
Some clients reported difficulties placing orders in physical and online stores days before the public announcement. Ahorramas has more than 290 establishments spread mainly between the Community of Madrid, Castilla-La Mancha and areas of Castilla y León.