CFM Mozambique listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Mozambique
• Sector: Transportation
• Announcement date: January 16, 2026

The Qilin ransomware group has listed CFM Mozambique on its dedicated leak site, alleging that a data breach has occurred. This announcement, made on January 16, 2026, suggests that the threat actor claims to have successfully obtained data belonging to the organization.

The details of the claim

According to the announcement posted on the group's platform, the threat actor known as Qilin targeted CFM Mozambique. The listing appeared on January 16, 2026, which coincides with the date the group claims the attack took place. The publication of this listing on a ransomware leak site indicates that a cybersecurity incident may have occurred involving the institution's digital assets.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. When an organization refuses to meet the group's demands, the attackers often publish stolen information to increase the pressure. This specific incident involves a claim of a data breach rather than a simple encryption event, signaling a potential compromise of sensitive information.

Data involved in the incident

At this stage, there is no detailed information regarding the specific content of the leaked data. The provided screenshot associated with the listing does not contain sufficient clarity to verify the exact contents of the alleged breach. Furthermore, the group has not provided specific details regarding the total size of the data or the total count of files involved in the incident.

• No specific data types were named in the listing.

In many modern ransomware campaigns, attackers employ a tactic known as double extortion. In this scenario, the threat actor not only encrypts an organization's data to disrupt operations but also steals sensitive information beforehand. The threat of leaking this stolen data on public forums serves as a secondary layer of leverage to compel the victim to pay the ransom.

About CFM Mozambique

CFM (Portos e Caminhos de Ferro de Moçambique) is the state-owned national railway and port authority of Mozambique. The organization plays a critical role in the country's infrastructure by managing logistics and overseeing both railway transportation and port operations. As a central entity in the nation's logistics network, the organization's digital stability is vital to the country's operational flow.

Impact and industry implications

This incident may create negative impacts on the organization's operational continuity. Because the Qilin group utilizes double extortion tactics, the organization may be facing the risk of sensitive data publication. Given that CFM Mozambique operates within the transportation sector, such an incident may lead to secondary risks regarding supply chain security, as disruptions in logistics can ripple through various interconnected industries.

Depending on the nature of the leaked data, the organization may face legal obligations and potential reputational damage. For organizations operating in critical infrastructure and transportation, maintaining robust cybersecurity posture is essential to mitigate these risks. Common defensive steps for organizations in this sector include implementing strict access controls, maintaining offline backups, and conducting regular security audits to protect the integrity of the supply chain.

The Qilin group has been active since 2022 and has historically targeted various sectors, demonstrating a diverse range of targets. As organizations continue to digitize their logistics and transportation operations, the risk of targeted ransomware attacks remains a significant concern for global supply chain security.