Berko İlaç Ve Kimya San Aş listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: May 23, 2025

Qilin ransomware group claims data breach at Berko İlaç Ve Kimya San Aş

The threat actor known as Qilin has listed the Turkish pharmaceutical company Berko İlaç Ve Kimya San Aş on its dedicated leak site. This announcement, made on May 23, 2025, constitutes an allegation of a data breach against the organization. While the listing is a claim made by the ransomware group, it highlights the ongoing threat posed by sophisticated cybercriminal entities to critical industrial sectors.

Details of the alleged attack

According to the claims made by the Qilin group, the threat actors gained unauthorized access to the organization's network on May 22, 2025. This means the alleged intrusion occurred just one day before the public announcement on the group's leak portal. The timing suggests a rapid progression from initial access to the public listing of the victim.

The group appears to be employing a double-extortion strategy. In such scenarios, ransomware actors do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive information. By threatening to publish the stolen data on their leak site, the attackers aim to exert maximum pressure on the victim to meet their demands, leveraging the threat of public exposure and regulatory scrutiny.

Information regarding the alleged leaked data

At this stage, there is no specific information available regarding the nature or the volume of the alleged leaked data. The group has not provided details concerning the file count or the specific types of files that were purportedly accessed. While a screenshot was provided by the threat actor, the image is too blurry to allow for a clear identification of its contents. Consequently, the specific contents of the breach remain unverified and unidentified.

Affected data types

• The listing names no specific data types.

About Berko İlaç Ve Kimya San Aş

Berko İlaç is a pharmaceutical manufacturing company based in Türkiye. Founded in 1984 by pharmacist Berat Beran, the organization has established a long-standing presence in the healthcare industry. The company's core operations involve the development and production of human pharmaceuticals, food supplements, and various other healthcare products.

Potential implications and industry risks

The Qilin group is a known threat actor that has been active since 2022, frequently utilizing double-extortion tactics to target various organizations. Because Berko İlaç operates within the pharmaceutical sector, any potentially leaked sensitive data could fall under the scope of the KVKK (Turkish Personal Data Protection Law). This adds a layer of legal complexity and regulatory risk to the incident.

An incident of this nature can lead to several significant consequences for an organization. Operationally, a breach can disrupt essential manufacturing and distribution processes. Beyond operational downtime, there are secondary risks to employees and business partners whose information may be involved. Furthermore, such incidents often result in substantial reputational damage and potential legal consequences for the organization involved.

Given the historical patterns of the Qilin group, there remains a possibility that the data could be released in the future. Organizations in the manufacturing and pharmaceutical sectors often face these types of threats, which necessitate robust defensive measures. Common defensive strategies typically include maintaining rigorous patch management, implementing multi-factor authentication, and conducting regular network monitoring to detect unauthorized access early. Given the sensitivity of pharmaceutical data, ensuring compliance with data protection laws like KVKK is a critical component of a comprehensive cybersecurity posture.