Denso listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Japan
• Sector: Manufacturing
• Announcement date: April 24, 2026

Qilin ransomware group claims data leak at Denso

The Qilin ransomware group has claimed responsibility for a data leak involving Denso, a major global automotive supplier. According to an announcement posted on the group's leak site, the threat actor alleges they have successfully exfiltrated data belonging to the organization. This claim follows a pattern of behavior often associated with modern ransomware operations that prioritize public pressure through data exposure.

Details of the alleged attack

The Qilin ransomware group has listed Denso on its dedicated leak site, marking a significant escalation in their campaign against the organization. The group alleges that they gained unauthorized access to the organization's data during a cyber event that reportedly occurred on March 20, 2026. This initial access, according to the group's claims, preceded the public announcement made on April 24, 2026.

Ransomware groups often use leak sites to host information about their victims, creating a public record of the breach to increase pressure on the target. These sites typically serve as a platform where the attackers can post screenshots or lists of stolen files to demonstrate the success of their intrusion. In this specific instance, the group's announcement serves as the primary source of the claim that Denso's data has been compromised.

Information regarding the leaked data

Despite the announcement on the leak site, specific details regarding the content of the allegedly leaked data have not been shared by the attackers. The group provided a screenshot that includes the organization's name and logo, but this visual evidence does not provide specific information regarding the nature or the specific types of data that were compromised during the incident.

The listing names no specific data types or categories of information that have been stolen. Because the group has not provided a breakdown of the files, the exact scope of the information loss remains unknown at this time. This lack of transparency is common in the early stages of a ransomware extortion attempt, where attackers may withhold specific details to maintain leverage during negotiations.

About Denso Corporation

Denso Corporation is a leading global Japanese automotive supplier that develops and manufactures automotive technologies, systems, and components. The company specializes in several critical areas of automotive engineering, including powertrain, thermal, mobility, and electronic systems. As a major player in the manufacturing sector, the company provides essential technologies that support the global automotive supply chain.

Analysis and potential risks

As a threat actor known for the practice of double extortion, the Qilin group may be attempting to exert pressure by threatening to publish the organization's data. Double extortion is a tactic where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data, threatening to leak it to damage the company's reputation or force a ransom payment. Given the organization's operations in the manufacturing sector, various risks may arise, such as operational disruptions and the exposure of intellectual property.

Furthermore, as an organization operating in Japan, specific legal obligations regarding data breach notifications under the APPI (Act on the Protection of Personal Information) may be triggered. If the leaked data were to include employee or customer information, secondary risks such as identity theft and targeted phishing attacks may be observed. Organizations in the manufacturing sector often face these multifaceted risks when targeted by sophisticated ransomware groups.

To defend against such threats, organizations typically focus on robust security frameworks. This includes maintaining strict access controls, implementing comprehensive monitoring to detect unauthorized data movement, and ensuring that employees are trained to recognize phishing attempts. Additionally, maintaining offline backups and ensuring a rapid incident response plan are critical components of a modern cybersecurity posture designed to mitigate the impact of both encryption and data exfiltration.