Centralno grijanje Tuzla listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Bosnia & Herzegovina
• Sector: Manufacturing
• Announcement date: May 27, 2025

Centralno grijanje Tuzla targeted by Qilin ransomware group

The Qilin ransomware group has officially listed the Bosnia and Herzegovina-based organization Centralno grijanje Tuzla on its dedicated leak site. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack that involves the threat of data exposure.

Details of the claimed attack

The Qilin ransomware group announced the listing of Centralno grijanje Tuzla on May 27, 2025. While the announcement was made on late May, the threat actors claim to have successfully gained unauthorized access to the organization's internal systems as early as May 19, 2025. This indicates a period of presence within the network prior to the public announcement.

The group is reportedly employing a double extortion tactic in this incident. Double extortion is a common strategy used by modern ransomware groups where, in addition to encrypting an organization's files to disrupt operations, the attackers also steal sensitive information. The attackers then threaten to publish this stolen data on a public leak site if the ransom demands are not met. This method increases the pressure on the victim by leveraging the threat of reputational damage and regulatory scrutiny.

Information regarding the leaked data

At this stage, there is no specific information provided in the record or the associated documentation regarding the nature of the leaked or threatened data. The listing does not specify the types of files, the volume of data, or the specific databases that may have been accessed by the attackers.

• No specific data types have been identified in the listing.

About Centralno grijanje Tuzla

Centralno grijanje Tuzla is a public utility company located in Bosnia and Herzegovina. Since 1977, the organization has been responsible for providing central heating services to the city. It serves as a vital provider of heating solutions, delivering reliable and quality services to both residential and commercial buildings throughout the Tuzla region.

Potential impact and organizational risks

This incident may pose significant risks to the organization's operational continuity. Because the target is a utility provider, disruptions could potentially affect critical infrastructure services. Furthermore, depending on the nature of the alleged leaked data, the organization may face risks such as identity theft or targeted phishing attacks directed at employees and service users.

From a regulatory perspective, the organization may face legal obligations under the data protection regulations applicable in Bosnia and Herzegovina. Given the historical activities of the Qilin group, it is assessed that the group may continue to increase pressure on the victim through its double extortion strategy.

To address such incidents, organizations typically need to conduct thorough forensic investigations to determine the full scope of the breach. Such investigations are essential to understand how the attackers gained access and what specific information was compromised. Additionally, organizations often find it necessary to notify affected parties to mitigate the risks of secondary attacks like phishing or identity theft. In the manufacturing and utility sectors, maintaining robust cybersecurity posture and incident response plans is a critical component of managing operational risks.