Gericke AG listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: October 23, 2025

Gericke AG listed on Qilin ransomware leak site

The Swiss-based manufacturing company Gericke AG has been listed on the leak site of the Qilin ransomware group. According to an announcement made by the threat actor, the organization has been targeted in a cyberattack, with the group claiming to have compromised company data. This announcement was posted on the group's leak portal on October 23, 2025.

Details of the alleged attack

The Qilin ransomware group has officially announced that it has targeted Gericke AG through a post on its dedicated leak portal. In this post, the group includes information regarding the company's operations and provides samples of various documents to support their claim. The group asserts that the incident, which they claim occurred on October 23, 2025, resulted in the compromise of the company's data.

Ransomware groups often utilize leak sites to increase pressure on their victims. These sites serve as a public platform where the group can post information about the targeted organization, often including proof of the breach to validate their claims. This tactic is a core component of modern cyber extortion campaigns, designed to damage the reputation of the victim and coerce them into meeting ransom demands.

Data involved in the incident

The screenshot shared on the leak site displays samples of documents that allegedly belong to the company. However, there is no detailed information regarding the full scope or the specific nature of the compromised data. The listing does not provide information regarding the total size of the data or the specific file count involved in the breach. Furthermore, no ransom demand has been specified in the public announcement.

The listing names no specific data types that have been compromised.

About Gericke AG

The Gericke Group is a Swiss-based entity that has been involved in the design and manufacture of equipment and systems for bulk material processing for over 125 years. Beyond manufacturing, the company provides specialized engineering and consulting services for various industrial processes.

Potential risks and industry implications

This incident, allegedly carried out by the Qilin group, may pose significant risks to the company's trade secrets and operational data. Given the nature of the manufacturing sector, the loss of proprietary technical information or process details can have long-term consequences for a company's competitive standing.

As a Swiss-based entity, any potential data breach may be subject to the Swiss Federal Act on Data Protection (FADP). Organizations operating within this jurisdiction must be mindful of the regulatory requirements regarding the handling and protection of personal and corporate data. Furthermore, because the Qilin group is known for using double-extortion tactics, it is possible that they may attempt to pressure the organization by threatening to publish the acquired data.

Double extortion is a method where attackers not only encrypt a victim's systems but also steal sensitive information. The threat of leaking this data is used as secondary leverage to ensure payment. In such scenarios, any employee or customer information contained within the leaked data could potentially serve as a basis for secondary attacks and phishing campaigns, where attackers use stolen details to impersonate legitimate entities or target individuals within the organization's network.

For organizations in the manufacturing sector, maintaining robust cybersecurity postures is essential to protect intellectual property and operational continuity. Common defensive steps include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other social engineering vectors.