Estes Forwarding Worldwide listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Transportation
• Announcement date: June 23, 2025

Qilin claims data theft from Estes Forwarding Worldwide

The Qilin ransomware group has officially listed Estes Forwarding Worldwide on its dedicated leak site. According to the announcement made on June 23, 2025, the threat actor group claims to have successfully obtained data belonging to the organization. This development follows a period of alleged unauthorized access to the company's digital infrastructure.

The group's announcement suggests that the cyberattack, which was directed at the organization's networks, took place on May 24, 2025. By publishing information related to the victim on their platform, the Qilin group appears to be employing a double-extortion tactic. In such scenarios, ransomware actors do not merely encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive information and threaten to leak it publicly to increase the pressure on the organization to pay.

Data types identified in the leak

While the specific volume of the stolen data and the exact ransom demand remain unknown, the group has provided visual evidence of the breach. Screenshots released by the attackers show various samples of sensitive information that allegedly belong to the organization. These samples indicate that the breach involves a mix of personal and corporate information.

Based on the available evidence, the following types of data are reportedly involved in the leak:

• Employee identification data
• Corporate tables
• Passport-like documents

The presence of such sensitive documentation, including what appear to be employee identification cards and passport-style documents, highlights the potential severity of the exposure for the individuals involved.

About Estes Forwarding Worldwide

Estes Forwarding Worldwide (EFW) is a prominent player in the logistics and freight forwarding industry. The company specializes in providing comprehensive door-to-door solutions for its clients. Headquartered in Richmond, Virginia, EFW operates as a subsidiary of Estes, which is recognized as one of the largest privately held freight transportation firms in the United States.

Risk assessment and industry implications

The Qilin group, which has been known to operate since 2022, is a recognized entity that frequently utilizes double-extortion methods. The documents shared by the group suggest that the personal data of employees may have been leaked. This specific type of exposure significantly increases the risk of identity theft for the organization's staff, as sensitive identity documents are highly valuable to malicious actors for fraudulent activities.

Because the organization is based in the United States, this breach may trigger various legal and regulatory requirements. The incident may necessitate investigations regarding state-level data protection laws and the fulfillment of potential legal obligations regarding data breach notifications. Furthermore, the nature of the leaked data suggests that it could be utilized by the attackers to launch targeted phishing attacks against the organization or its employees.

From a broader perspective, the organization's position within the logistics sector introduces secondary risks related to supply chain security. In a highly interconnected industry like transportation, a breach in one major logistics provider can have ripple effects across the supply chain. Organizations in this sector often prioritize robust defensive measures, such as implementing strict access controls, conducting regular network monitoring, and ensuring comprehensive employee training to mitigate the risk of such targeted attacks.