Ferrocortes listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Colombia
• Sector: Manufacturing
• Announcement date: August 6, 2025

The Qilin ransomware group has listed the Colombian manufacturing company Ferrocortes on its dedicated leak site. The announcement, which appeared on August 6, 2025, includes claims of a significant data breach involving the organization's sensitive information.

The alleged data breach event

According to the announcement published by the Qilin ransomware group, the company has been targeted in a cyberattack. The group alleges that they have successfully compromised data related to the company's business operations. This claim was made through a formal listing on their leak site, which is a common tactic used by ransomware actors to pressure victims into paying ransoms.

The group's announcement suggests that the breach is not merely a disruption of services but involves the actual theft of corporate information. While the group has claimed the attack occurred on the same day as the announcement, the specific technical details of how the perimeter was breached remain undisclosed in the public listing.

Data involved in the claim

The Qilin group has made specific claims regarding the types of information they have allegedly exfiltrated from the organization. While the group provided screenshots containing blurred document samples to support their claims, the exact volume of the stolen data and the total file count have not been specified. The information identified in the announcement includes:

• Business data
• Financial records
• Customer complaint records

The inclusion of customer complaint records and financial data suggests that the breach may extend beyond internal operational files to include sensitive information that could impact external stakeholders.

About Ferrocortes

Ferrocortes S.A.S is a Colombia-based company that provides high-quality steel solutions for heavy machinery and hardware. The firm manufactures customized steel sheets and profiles catering to various industrial sectors, including mining.

Impact assessment and industry implications

This alleged breach by the Qilin group may negatively impact the company's operational continuity and commercial reputation. Because the group employs double-extortion tactics—a method where attackers both encrypt systems and threaten to leak stolen data—the threat of publicly releasing the information could create secondary risks for the company's clients and business partners.

The potential exposure of financial and customer-related data means the company may face legal obligations under Colombian data protection regulations. Furthermore, it is possible that the leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its associates. Given the group's history, it is possible that the attack involved broad access to corporate networks.

In the manufacturing sector, such incidents highlight the importance of robust network segmentation and strict access controls. Organizations in this sector often manage complex supply chains and sensitive industrial specifications, making them attractive targets for sophisticated threat actors. To mitigate these risks, companies typically implement comprehensive monitoring, regular security audits, and rigorous data encryption protocols to protect both intellectual property and client information.