dgr.at listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Austria
• Sector: Technology
• Announcement date: April 4, 2025

Qilin ransomware group claims attack on dgr.at

The Qilin ransomware group has listed the Austrian technology company dgr.at on its dedicated leak site. According to the announcement made on April 4, 2025, the threat actor group claims to have successfully obtained data belonging to the organization. This listing follows a pattern of extortion common among modern ransomware operations, where victims are publicly named to increase pressure on the target.

The group has announced that the allegedly stolen data is scheduled to be made available for public download on April 14, 2025. The listing appeared on the group's leak platform and included specific information regarding the company's ERP solutions. This type of public pressure is a hallmark of the group's operational methodology.

Details regarding the alleged data breach

At this stage, there is no specific information regarding the nature or the content of the allegedly leaked data. While the group has posted a listing, the content of the provided screenshot cannot be clearly identified, leaving the exact scope of the breach unknown. The listing names no specific data types.

Ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information before triggering the encryption. The goal is to threaten the victim with the public release of this data if the ransom is not paid. This adds a layer of complexity to incident response, as organizations must manage both the technical recovery of systems and the legal and reputational fallout of a potential data leak.

About dgr.at

DGR is an Austrian technology company that specializes in the development of enterprise resource planning (ERP) software. Specifically, the company develops the PROFI.neo solution. This software is designed to meet the specialized needs of companies operating within the building services sector. The target industries for their solutions include electrical, plumbing, heating, ventilation, and air conditioning installation services.

Potential risks and security implications

This situation may pose significant risks to the company's operational processes and its commercial reputation. Because the company operates within Austria, a potential data breach could lead to legal sanctions under the General Data Protection Regulation (GDPR). Compliance with such frameworks is a critical aspect of operating within the European Union, as unauthorized access to data can trigger strict regulatory oversight.

The use of double extortion by the Qilin group may create secondary risks for the company's customers and business partners. If sensitive information is indeed leaked, it could facilitate identity theft or targeted phishing attacks against the organization or its associates. Such attacks often leverage the specific context of the stolen data to appear more convincing to the targets.

Given the group's past activities, the company's network security processes may need to be re-evaluated. For organizations in the technology and software development sectors, maintaining robust defensive postures is essential. Common defensive steps for organizations facing such threats include implementing multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments to mitigate the risk of unauthorized access. Continuous monitoring of network traffic and strict access controls are also vital components of a modern cybersecurity strategy designed to prevent the exfiltration of sensitive corporate data.