Elitavia.com listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Slovenia
• Sector: Transportation
• Announcement date: May 24, 2025

Qilin ransomware group targets elitavia.com

The Qilin ransomware group has officially listed elitavia.com on its dedicated leak site. According to the announcement, the threat actor group claims to have successfully targeted the organization and obtained access to its digital assets. This listing serves as a public claim by the group that they have compromised the company's systems and extracted information.

The announcement was made on May 24, 2025, the same day the group claims the attack occurred. This rapid succession between the alleged intrusion and the public listing is a common tactic used by ransomware operators to increase pressure on their targets. By publishing the name of the victim on a leak site, the group aims to damage the organization's reputation and create urgency during negotiations.

Details of the alleged intrusion

The Qilin group's announcement includes claims regarding an interference with the organization's operational processes. This suggests that the attack may have extended beyond simple data theft to potentially disrupting the day-to-day business activities of the company. The group asserts that they have accessed the organization's digital assets and have successfully copied data from these systems.

While the group has made these claims, the full scope of the breach remains unclear. The evidence provided by the group consists of screenshots containing blurred document samples. These samples appear to represent internal correspondence or operational records belonging to the organization. However, there is no clear information provided regarding the full scope of the leaked data or the specific types of files that were accessed during the incident.

Data involvement

The listing names no specific data types or categories of information that have been stolen.

About elitavia.com

Elit'Avia is one of Europe's leading business aircraft operators. The company provides integrated aviation services, which include aircraft sales, leasing, charter, aircraft management, and flight operations management. Based in Slovenia, the organization operates within the highly regulated transportation sector.

Risk assessment and industry implications

The Qilin group is known for utilizing double extortion methods to pressure organizations. In a double extortion scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information and threaten to leak it publicly unless a ransom is paid. This method significantly increases the leverage held by the attackers, as the threat of data exposure can cause irreparable reputational and legal damage.

This specific situation may create a risk of exposing sensitive data belonging to the organization's employees and customers. Because the organization is based in Slovenia, any potential data leaks may be subject to the General Data Protection Regulation (GDPR), which could lead to significant legal sanctions for the company. Furthermore, there are secondary risks involved, such as the possibility that leaked data could be used for identity theft or targeted phishing attacks against the organization's stakeholders.

The group's past activities suggest that they may maintain long-term persistence in corporate networks using similar methods, making them a persistent threat to high-value targets. Organizations operating in the transportation and aviation sectors often face heightened risks due to the sensitive nature of their operational and client data. To defend against such threats, organizations typically focus on robust network monitoring, strict access controls, and comprehensive employee training to prevent initial entry via phishing or other common vectors. Maintaining regular, offline backups and implementing a zero-trust architecture are also common defensive strategies used to mitigate the impact of ransomware and data exfiltration attempts.