Skip to content
Leak-site post naming Mastelli S.r.l., captured by ThreatCluster

Mastelli S.r.l.

qilin

Ransomware leak-site victim intelligence · EN

Views
27
Posted
Oct 18, 2026
Country
IT
Industry
Healthcare Services

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

The leak post from group qilin claims Mastelli S.r.l. is the victim, described as a healthcare services provider with the domain mastelli.com; the post does not specify what data were taken or how much. It includes a dark web onion URL and a TOX hash, and cites Wikileaks as a source; the post was published on 2026-10-18 and is shown as publication status "listed" on the leak page. No explicit data categories or volumes are provided in the leak page beyond those identifiers.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
mastelli.com

What was taken

Blog Mastelli S.r.l.

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX
7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
onion_url
http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
wikileaks_source
https://wikileaks2.com/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo of Mastelli Officina Bio-Farmaceutica Sanremo, featuring the name "Mastelli" in blue with a green and red element indicating "Dal 1952."
onion leak page100 KB