ACI Proyectos SAS listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Colombia
• Announcement date: October 10, 2026

Qilin ransomware group claims data breach at ACI Proyectos SAS

The Qilin ransomware group has officially listed the Colombian organization ACI Proyectos SAS on its dedicated leak site. Through this announcement, the threat actor group has claimed to have successfully executed a data breach against the company, marking a significant escalation in their targeting of the firm.

The announcement, which was published on October 10, 2026, serves as a public notification of the alleged compromise. By posting the organization's name on their portal, the group signals its intent to utilize the stolen information for extortion purposes. This method is a hallmark of modern ransomware operations, where the threat of leaking sensitive information is used to pressure victims into meeting financial demands.

Details of the alleged attack

According to the claims made by the Qilin group, the attackers managed to gain unauthorized access to the internal systems of ACI Proyectos SAS. The group asserts that this access allowed them to obtain data belonging to the organization. The timing of the announcement, coinciding with the claimed date of the attack, suggests a rapid progression from initial infiltration to the public disclosure phase.

This type of activity is characteristic of double extortion tactics. In a double extortion scenario, ransomware actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of releasing this data on a public leak site provides the attackers with additional leverage, as the victim faces not only operational downtime but also significant reputational damage and legal liabilities resulting from the exposure of private information.

Status of the leaked data

At this stage of the incident, there is no clear information regarding the specific nature or the volume of the allegedly leaked data. While the group's leak site features a screenshot that includes the organization's logo, providing visual confirmation of the target, there is no specific file sample or a detailed list of data types shared with the public. Consequently, the exact scope of the information compromise remains unknown.

Affected data types

• The listing names no specific data types.

About ACI Proyectos SAS

ACI Proyectos SAS is a company based in Colombia that specializes in engineering and project management. The organization operates within several critical fields, including infrastructure, construction, and the provision of various consulting services. Given its involvement in large-scale infrastructure and construction projects, the company manages complex technical data and various professional services.

Risk assessment and implications

The Qilin group is a known threat actor that has been active since 2022. They are recognized for their use of double extortion tactics to maximize their leverage over victims. This specific incident poses a potential risk that sensitive corporate or customer data from ACI Proyectos SAS may be leaked to the public. Such a leak could lead to various secondary risks, including the potential for identity theft or the execution of highly targeted phishing attacks against the organization's stakeholders or clients.

Furthermore, because ACI Proyectos SAS is based in Colombia, the organization may encounter challenges regarding compliance with local data protection regulations following a breach. The potential for regulatory scrutiny and the necessity of adhering to regional privacy laws add another layer of complexity to the situation. From an operational standpoint, the group's past activities suggest that the organization's operational continuity could be negatively impacted by this attack.

In general, organizations facing such threats can benefit from implementing robust defensive measures. These include maintaining offline, immutable backups to ensure data can be restored without paying a ransom, implementing strict multi-factor authentication across all systems, and maintaining continuous monitoring to detect unauthorized access early. Additionally, regular security awareness training can help mitigate the risk of initial access through phishing, which is a common entry point for ransomware groups.