DAOR E&C Co., Ltd listed on qilin ransomware leak site

• Ransomware group: qilin
• Country: South Korea
• Sector: Manufacturing
• Announcement date: August 20, 2025

DAOR E&C Co., Ltd targeted by qilin ransomware group

The qilin ransomware group has officially listed the South Korean construction firm DAOR E&C Co., Ltd on its dedicated leak site. According to the announcement made by the threat actors, the organization's internal data has been compromised. The group claims to have successfully gained access to the organization's internal networks and subsequently copied various sets of data from the environment.

The announcement regarding this incident was published on August 20, 2025. The threat group alleges that the breach involves the exposure of both commercial and personal information belonging to the organization. While the group has claimed responsibility for the intrusion, the specific details regarding the volume of data stolen or the specific ransom demand remain undisclosed by the attackers.

Details of the alleged data breach

The qilin group has provided specific claims regarding the types of information they have allegedly exfiltrated from the victim's network. According to the group's announcement, the stolen datasets include sensitive corporate assets and private information. The claims suggest that the breach involves a variety of internal documents that could impact both business operations and individual privacy.

The specific types of data mentioned in the group's claim include:

• Employee personal data
• Commercial designs
• Technical drawings
• Internal correspondence

The presence of such diverse data types in a leak site announcement highlights the breadth of the alleged intrusion, ranging from high-level management documents and technical project files to the private details of the workforce.

Profile of DAOR E&C Co., Ltd

DAOR E&C Co., Ltd is a prominent South Korean construction company with a long-standing history in the infrastructure sector. The company specializes in the production and construction of complex concrete structures. Their expertise covers a wide range of specialized engineering projects, including the construction of concrete bridges, cable-stayed bridges, LNG tanks, underground tunnels, and various heavy lifting structures.

With over 40 years of experience in the industry, the organization has established itself as a significant player in large-scale infrastructure projects, managing the intricate requirements of modern civil engineering and structural production.

Potential impact and security implications

This incident carries significant risks for the organization, particularly regarding the exposure of trade secrets and the personal information of its employees. The loss of technical drawings and commercial designs could jeopardize the company's competitive advantage and intellectual property. Furthermore, the exposure of employee data, such as names, addresses, phone numbers, and emails, may lead to secondary threats such as identity theft or targeted phishing attacks directed at the organization's staff.

From a legal perspective, the organization may face potential sanctions under South Korea's Personal Information Protection Act (PIPA) due to the alleged exposure of personal data. The qilin group is known for employing double extortion tactics, a method where attackers not only encrypt data but also threaten to leak it to exert maximum pressure on the victim to pay the ransom.

The qilin group has been active since 2022 and has targeted various sectors, which may lead to negative impacts on the operational continuity of the affected organization. In such scenarios, organizations typically focus on strengthening network segmentation, implementing robust multi-factor authentication, and enhancing monitoring capabilities to detect unauthorized access. Regular security awareness training is also a critical component in defending against the phishing risks that often follow such data leaks.