HUB ASSET MANAGEMENT Co listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Japan
• Sector: Financial Services
• Announcement date: September 25, 2025

Qilin claims responsibility for HUB ASSET MANAGEMENT Co data breach

The threat actor known as Qilin has published an announcement on its leak site involving HUB ASSET MANAGEMENT Co. According to the claims made by the group, they have successfully gained access to the organization's internal systems and have proceeded to copy sensitive data. This announcement, which appeared on September 25, 2025, marks a significant development in the ongoing activities of the group.

The group's claim involves the publication of various documents that appear to be related to the company's internal operations. While the specific volume of data or the exact number of files taken have not been disclosed by the group, the listing indicates a targeted effort to exfiltrate information from the organization's infrastructure.

Details of the claimed data theft

The information provided by the threat actor suggests that the breach involves critical documentation. Based on the evidence presented in the listing, which includes screenshots of blurred document samples, the stolen information appears to consist of sensitive corporate and financial records. The presence of these samples on a leak site is a common tactic used by ransomware groups to pressure victims into meeting ransom demands.

The specific types of data mentioned in the listing include:

• Financial statements
• Corporate data

The use of blurred images is a standard method used by such groups to prove the legitimacy of their claims without immediately exposing all the sensitive content to the public, thereby maintaining leverage during extortion negotiations.

About HUB ASSET MANAGEMENT Co

HUB ASSET MANAGEMENT Co is an alternative investment management company based in South Korea. The company provides portfolio management services aimed at setting standards for best practices in alternative investments. As a firm operating within the financial services sector, the integrity of its data and the security of its client information are central to its operational mandate.

Risk assessment and industry implications

This alleged leak poses a substantial risk to the organization, as it may lead to the exposure of vital financial data and sensitive customer information. For an institution operating within the financial services sector, such a breach can result in a significant loss of customer trust and widespread reputational damage. Furthermore, the organization may face legal sanctions under the Act on the Protection of Personal Information (APPI) in Japan.

The Qilin group is known to employ double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt a victim's data to disrupt operations; they also steal sensitive information before the encryption process begins. This allows them to threaten the victim with the public release of the data if the ransom is not paid. This tactic significantly increases the pressure on the target, as the threat of data exposure can lead to secondary risks, such as the data being used in targeted phishing attacks against the company or its clients.

The Qilin group has been active since 2022 and is recognized for targeting a wide range of sectors. For organizations in the financial sector, defending against such threats requires robust security postures. Common defensive strategies include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities before they can be exploited by threat actors.