Natilait listed by the Cicada3301 ransomware group

Overview

The Cicada3301 ransomware group has listed Natilait, a Tunisian dairy company, on its leak site. The group's post references a data size of 280 GB. The listing appeared on 22 April 2025. At the time of analysis, the group's leak page was not reachable.

What was published

The group claims to have exfiltrated approximately 280 GB from the company. The archive is expected to include production records, corporate documents and financial data.

Risks for affected individuals

• Employees' personal records may be exposed.
• Production and commercial data could be misused.
• Financial information may enable fraud attempts.

What remains unknown

• The composition of the 280 GB archive.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

Employees should update credentials and watch for phishing referencing the company. Natilait should notify staff and partners, engage cybersecurity experts, and coordinate with Tunisian authorities on the response.