Gullco International listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Canada
• Sector: Manufacturing
• Announcement date: November 9, 2025

The Qilin ransomware group has listed Gullco International on its leak site, alleging that the organization has been the victim of a data breach. This announcement, published on November 9, 2025, marks a new potential incident involving the Canadian manufacturing firm.

The claimed attack and extortion method

According to the announcement made by the threat actor known as Qilin, the group has conducted a cyberattack against Gullco International. The group claims to have successfully exfiltrated data from the organization. This operation appears to follow a double-extortion strategy, a common tactic used by modern ransomware groups.

In a double-extortion model, threat actors do not merely encrypt a victim's systems to disrupt operations. Instead, they focus on stealing sensitive information before the encryption phase. The attackers then use the threat of leaking this stolen data on public forums or leak sites to coerce the organization into paying a ransom. This method increases the pressure on the victim, as the threat of public exposure can cause significant reputational and legal damage, regardless of whether the company can restore its systems from backups.

Information regarding the exfiltrated data

At this time, there is no information regarding the nature of the data allegedly exfiltrated in the screenshot or the provided records. The listing does not specify the types of files, the volume of data, or the specific contents that have been targeted by the Qilin group.

About Gullco International

Gullco International is a Canada-based manufacturing company specializing in welding automation and cutting equipment. The company provides industrial solutions worldwide, focusing on the development of automation technologies such as welding carriages and track systems.

Risk assessment and industry implications

This incident may pose risks to Gullco International regarding data privacy and operational continuity. The Qilin group may attempt to coerce the organization into paying a ransom by threatening to publish exfiltrated data through its double-extortion model. As a Canada-based entity, a potential data breach could trigger legal obligations and notification requirements under PIPEDA.

Furthermore, depending on the nature of the compromised data, employees or business partners may face risks of identity theft and targeted phishing attacks. The group's known history suggests a tendency to infiltrate corporate networks and encrypt sensitive information.

For organizations operating within the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. To defend against such threats, companies often implement multi-factor authentication, maintain offline backups, and conduct regular network monitoring to detect unauthorized data exfiltration. Given the specialized nature of industrial automation companies, protecting intellectual property and sensitive technical specifications is a critical component of maintaining a secure operational environment.