Fulgar: RansomHouse strikes again as Fulgar’s confidential files appear online, exposing finances, client lists, and global operations

Fulgar Hit by RansomHouse Ransomware Attack, Exposing Sensitive Data

Fulgar, a leading synthetic yarn producer supplying major fashion brands like H&M, Adidas, Wolford, and Calzedonia, has confirmed a ransomware attack linked to the RansomHouse group. The attackers listed Fulgar on their leak site on November 12, claiming to have encrypted company data since October 31.

Leaked screenshots revealed internal documents, including bank balances, invoices, financial records, and sensitive communications, raising concerns about potential follow-up attacks such as targeted phishing campaigns. The breach underscores the risks of exposed insider details, which threat actors can exploit for further compromise.

RansomHouse, active since 2021, has targeted over 100 victims and has been linked by U.S. cyber authorities to affiliates collaborating with Iranian actors, often providing encryption tools in exchange for a share of ransom payments.

Fulgar, a key player in the textile industry since the 1970s, operates Europe’s largest spinning mill and supplies materials for hosiery, lingerie, activewear, and technical textiles across Italy, Sri Lanka, and Turkey. The incident highlights vulnerabilities in supply chains, even among well-established manufacturers.

Source: https://www.techradar.com/pro/hackers-spin-a-tedious-yarn-fabric-supplier-behind-h-and-m-adidas-and-more-hit-by-worrying-cyber-breach

Fulgar cybersecurity rating report: https://www.rankiteo.com/company/fulgar-s-p-a

"id": "FUL1772375035",
"linkid": "fulgar-s-p-a",
"type": "Ransomware",
"date": "11/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': ['H&M',
                                               'Adidas',
                                               'Wolford',
                                               'Calzedonia'],
                        'industry': 'Textile (Synthetic Yarn Production)',
                        'location': ['Italy', 'Sri Lanka', 'Turkey'],
                        'name': 'Fulgar',
                        'type': 'Company'}],
 'data_breach': {'data_encryption': True,
                 'data_exfiltration': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Bank balances',
                                              'Invoices',
                                              'Financial records',
                                              'Sensitive communications']},
 'date_detected': '2023-10-31',
 'date_publicly_disclosed': '2023-11-12',
 'description': 'Fulgar, a leading synthetic yarn producer supplying major '
                'fashion brands like H&M, Adidas, Wolford, and Calzedonia, has '
                'confirmed a ransomware attack linked to the RansomHouse '
                'group. The attackers listed Fulgar on their leak site on '
                'November 12, claiming to have encrypted company data since '
                'October 31. Leaked screenshots revealed internal documents, '
                'including bank balances, invoices, financial records, and '
                'sensitive communications, raising concerns about potential '
                'follow-up attacks such as targeted phishing campaigns.',
 'impact': {'data_compromised': 'Bank balances, invoices, financial records, '
                                'sensitive communications',
            'identity_theft_risk': 'Potential follow-up attacks such as '
                                   'targeted phishing campaigns'},
 'motivation': 'Financial gain',
 'ransomware': {'data_encryption': True,
                'data_exfiltration': True,
                'ransomware_strain': 'RansomHouse'},
 'references': [{'date_accessed': '2023-11-12',
                 'source': 'RansomHouse leak site'}],
 'threat_actor': 'RansomHouse',
 'title': 'Fulgar Hit by RansomHouse Ransomware Attack, Exposing Sensitive '
          'Data',
 'type': 'Ransomware'}