Qilin Ransomware Group Strikes Major European Insurer, Leaking Sensitive Data Including FC Barcelona Project Details The Qilin ransomware group, responsible for targeting over 300 organizations globally in the past year, has claimed responsibility for a cyberattack on Asefa, a Madrid-based subsidiary of France’s SMABTP, one of Europe’s leading mutual insurers. The breach, disclosed in April 2025, resulted in the exfiltration of over 200GB of sensitive data, including internal corporate documents, financial records, legal agreements, passport scans, and details of a major insurance program tied to FC Barcelona’s Camp Nou stadium redevelopment. SMABTP, founded in 1859 and headquartered in Paris, specializes in construction and liability insurance, with Asefa leading Spain’s market for construction defects coverage. The parent company reported revenues exceeding €4.3 billion in its latest financial filings. Following the attack, Asefa acknowledged the incident in a now-removed public notice, confirming temporary disruptions to internal systems while assuring clients that core insurance operations remained intact. Full digital functionality was suspended pending a comprehensive cybersecurity audit. Cybersecurity researchers at Cybernews warned that the leaked data could fuel identity theft, contractual fraud, and corporate espionage, particularly given the high-profile nature of the FC Barcelona project. The breach highlights the escalating threat posed by ransomware groups like Qilin, which has intensified its operations in 2025, adding 68 new victims in April alone. This incident marks one of the most significant cyber breaches involving a European insurer this year, raising concerns among regulators and clients about the protection of sensitive infrastructure-related data. While Asefa maintains that its primary services were unaffected, the attack underscores growing vulnerabilities in the insurance sector, particularly for firms with expansive international operations. The fallout is expected to prompt insurers across Europe to reassess their cybersecurity measures and risk exposure.