Dolan Construction listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Manufacturing
• Announcement date: December 20, 2025

Qilin ransomware group claims data breach at Dolan Construction

The Qilin ransomware group has officially listed Dolan Construction on its dedicated leak site, alleging that the organization has been the victim of a data breach. This announcement, made on December 20, 2025, marks a new development in the group's ongoing activities targeting various sectors. By listing the organization on their platform, the threat actors are publicly claiming to have compromised sensitive information belonging to the firm.

Details of the alleged attack

According to the announcement, the threat actor known as Qilin listed Dolan Construction on its leak platform on December 20, 2025. The group claims to have compromised the organization's data to facilitate this specific announcement. This type of listing is often interpreted as a tactical move by the group to exert pressure on the organization through its characteristic double-extortion tactics.

Double extortion is a common methodology used by modern ransomware groups. In this approach, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The attackers then threaten to release this stolen information on public leak sites if the ransom is not paid. This dual-threat strategy increases the pressure on the victim, as the organization faces both operational downtime and the potential for severe reputational and legal consequences resulting from the public exposure of their data.

Data involved in the incident

Regarding the specifics of the alleged breach, there is no specific information regarding the nature of the allegedly leaked data. The provided screenshot does not offer sufficient detail to verify the content, and the listing names no specific data types.

About Dolan Construction

Dolan Construction is a construction and general contracting firm based in California. The company provides construction services for commercial and industrial projects.

Analysis and potential implications

The Qilin group is a Ransomware-as-a-Service (RaaS) operation that has been active since 2022. The group is well-known for employing double-extortion tactics to maximize their leverage over victims. The potential exposure of the organization's data could lead to the disclosure of employee personal information or trade secrets. Because the organization is based in the United States, a potential data breach may trigger legal processes under state laws and federal regulations.

Furthermore, the leaked data could be utilized for secondary risks such as targeted phishing attacks or identity theft. Such attacks can be highly effective when the stolen data contains specific details about an organization's internal processes or personnel. The group's past activities suggest that such attacks may disrupt operational continuity and lead to significant reputational damage for the organization.

For organizations operating in the construction and manufacturing sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication across all remote access points, maintaining regular and offline backups of critical data, and conducting regular employee training to recognize phishing attempts. Furthermore, organizations should have a well-defined incident response plan to mitigate the impact of a potential breach and ensure compliance with relevant legal and regulatory frameworks.