Hongfa America listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Manufacturing
• Announcement date: December 22, 2025

Hongfa America targeted by Qilin ransomware group

Hongfa America has been listed on the leak site of the Qilin ransomware group, following allegations of a significant data breach. The threat actor has published a notice claiming responsibility for the incident, marking a new potential victim for the group.

Claims of network access and encryption

On December 22, 2025, the Qilin group published a notice on its dedicated leak platform. In this announcement, the group claims to have successfully obtained data belonging to Hongfa America. The threat actors allege that they have gained unauthorized access to the organization's internal networks and have proceeded to encrypt its data.

This type of activity is characteristic of modern ransomware operations. In such scenarios, attackers typically aim to disrupt business continuity by locking critical files and then use the threat of leaking sensitive information to pressure the victim into paying a ransom. This method is often referred to as double extortion, where the threat of data exposure is used as additional leverage alongside the encryption of systems.

Details regarding the leaked data

At this stage, there is no screenshot or detailed information available regarding the nature of the leaked data. The listing does not provide specific details concerning the types of files, the volume of information, or the specific systems that were compromised. Consequently, the listing names no data types.

About Hongfa America

Hongfa America is a manufacturing company specializing in relays and switching components. The organization provides electromechanical products designed for the industrial and automotive sectors. It operates as the American subsidiary of the China-based Hongfa group.

Analysis and potential risks

This incident suggests that the Qilin group is employing its double-extortion tactic to leak corporate data. Given the organization's operation in the manufacturing sector, there may be risks related to operational disruption and the exposure of intellectual property. The disruption of manufacturing processes can lead to significant supply chain issues and financial losses.

Furthermore, as the entity is based in the United States, potential data breaches could trigger legal processes under state-level privacy laws and federal regulations. The legal landscape regarding data protection is complex, and organizations must navigate various regulatory requirements following a confirmed breach. Additionally, if the leaked data includes employee or customer information, secondary risks such as identity theft and targeted phishing attacks may be observed.

The Qilin group has been operating since 2022 as a Ransomware-as-a-Service (RaaS) group. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks, allowing the group to target various sectors globally. Organizations in the manufacturing sector often face these types of threats and can mitigate risks by implementing robust security frameworks, such as regular network segmentation, strict access controls, and comprehensive backup strategies to ensure operational resilience.