Brodosplit listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Croatia
• Sector: Manufacturing
• Announcement date: December 3, 2025

The Qilin ransomware group has listed the Croatian manufacturing company Brodosplit on its dedicated leak platform. The announcement, which surfaced on December 3, 2025, involves a claim of a data breach against the organization.

The claimed attack

According to the announcement published by the Qilin ransomware group, the group has targeted Brodosplit and alleges that they have successfully obtained the company's data. The group has issued threats to release the allegedly stolen information publicly if their demands are not met. The claim of the attack was made on the same day the announcement was posted to the leak site.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms serve as a public stage where threat actors post information about compromised organizations to shame them into paying ransoms. This tactic is a central component of modern cyber extortion campaigns, where the threat of public exposure is used as a primary lever for negotiation.

Data involved in the incident

Regarding the specific nature or the scope of the data that has allegedly been stolen, there is no specific information provided in the available records. While visual files related to the company's operations may be visible in certain contexts, the specific content and the exact types of data involved remain unclear. The listing does not name any specific data types.

In many such incidents, the exact volume of stolen information remains a mystery until the threat actor chooses to release it or until the victim conducts a full forensic investigation. The lack of clarity regarding the data size and the specific file count makes it difficult to assess the immediate impact of the alleged breach at this stage.

About Brodosplit

Brodosplit is a major shipyard and shipbuilding company based in Split, Croatia. The organization specializes in the design, construction, and repair of various types of commercial and specialized vessels. As a significant player in the manufacturing and maritime sector, the company maintains complex operational workflows and technical designs.

Analysis and potential implications

The Qilin group is known for employing double-extortion tactics. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. This means that even if an organization can restore its systems from backups, it still faces the risk of its confidential information being leaked publicly. Given the group's history, there is a high probability that the data will be leaked if a ransom is not paid.

For a company like Brodosplit, the consequences of a confirmed breach could be significant. The disclosure of corporate trade secrets and operational data could negatively impact the company's competitive position within the shipbuilding industry. Furthermore, such an incident may create secondary risks for other stakeholders within the company's supply chain, as interconnected business processes may be exposed to further risk.

From a regulatory perspective, as a company operating in Croatia, Brodosplit may be subject to data breach notification requirements under the European Union's General Data Protection Regulation (GDPR). Compliance with these regulations is a critical aspect of managing the aftermath of a cyber incident in the European region.

To defend against such threats, organizations in the manufacturing and heavy industry sectors often implement various defensive measures. These include robust network segmentation to prevent lateral movement, continuous monitoring of data exfiltration patterns, and strict access controls to protect intellectual property. Maintaining a comprehensive incident response plan and ensuring regular offline backups are also essential components of a modern cybersecurity posture.