AT Solution listed on sinobi leak site with multimillion dollar ransom demand

• Ransomware group: sinobi
• Country: Pakistan
• Sector: Technology
• Announcement date: October 2, 2025

The sinobi ransomware group targets AT Solution

The technology firm AT Solution has been listed on the leak site of the threat actor known as sinobi. According to the announcement published on the group's leak site, the organization is facing a significant cyberattack. The post includes a ransom demand of 14.9 million dollars, signaling a high-stakes extortion attempt against the company.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data. By threatening to leak this information on public forums or dedicated leak sites, threat actors increase the pressure on the victim to pay the ransom. This method aims to maximize leverage by threatening the target's reputation and regulatory standing.

Details of the alleged attack

The threat actor known as sinobi claims to have compromised data belonging to AT Solution. The group published an announcement on its leak site regarding the incident, which is stated to have occurred on October 1, 2025. The announcement was officially posted on the leak site on October 2, 2025.

The claim suggests a rapid progression from the initial compromise to the public listing. While the specific methods used by the attackers to gain access remain unknown, the group has moved quickly to demand a massive payment of 14.9 million dollars. Such high ransom demands often indicate that the group perceives the target as a high-value entity with significant resources or critical data assets.

Data involved in the breach

The announcement specifies the types of information that the threat actor claims to have exfiltrated from the organization. The compromised data is reported to include:

• Financial data
• Customer data

The exposure of such sensitive information can lead to various secondary risks. When financial and customer records are leaked, they are frequently utilized by cybercriminals for identity theft or highly targeted phishing attacks. These follow-on attacks can further exploit the individuals whose data was taken, creating a ripple effect of security concerns beyond the initial breach.

About AT Solution

AT Solution is a technology company providing innovative solutions focused on mobile and web services. The firm develops professional business solutions, including open-source and SOA strategies, to provide its clients with a competitive edge. As a provider of digital services, the company plays a role in the technological infrastructure of its client base.

Potential impact and industry implications

This incident may pose risks to the institution's operational continuity and customer trust. The alleged financial and customer data could be utilized for identity theft or targeted phishing attacks. Given that the institution operates in the technology sector, secondary impacts on the supply chain may be observed, as the services provided by a technology firm often integrate with the systems of other businesses.

In the technology sector, a breach can have a cascading effect. Because technology providers often handle sensitive data or provide critical infrastructure for their clients, a compromise can potentially impact the security posture of their entire customer ecosystem. This highlights the importance of supply chain security and the need for organizations to vet the security practices of their third-party vendors.

To defend against such threats, organizations typically implement a multi-layered security strategy. This includes maintaining robust, offline backups to ensure operational continuity, implementing strict access controls to limit the movement of attackers within a network, and conducting regular security awareness training to prevent initial access via phishing. Furthermore, continuous monitoring and rapid incident response capabilities are essential for mitigating the damage once a breach is detected.

Assessment of the threat actor

Public information regarding the sinobi group is limited. However, the high amount of the alleged ransom may suggest that the group views the institution as a significant target. The scale of the demand reflects the potential impact the attackers believe they can exert through the threat of data exposure.