IGT listed on Qilin ransomware leak site following alleged data breach

• Ransomware group: Qilin
• Country: United States
• Sector: Technology
• Announcement date: November 19, 2025

Qilin group claims a cyberattack against IGT

The Qilin ransomware group has officially listed IGT on its dedicated leak site, alleging that the organization has been the target of a cyberattack. This announcement, made on November 19, 2025, marks a significant escalation in the threat landscape for the targeted entity. The group is employing a double-extortion tactic, a method where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage during negotiations.

In a double-extortion scheme, the threat actors aim to pressure the victim into paying a ransom by threatening to publish stolen data on public leak sites. This tactic is designed to maximize pressure on the organization, as the threat of a public data leak can cause significant reputational damage and legal complications, even if the organization has robust backups to restore its operational systems.

Details regarding the alleged data breach

While the Qilin group has claimed responsibility for the attack, specific details regarding the scope of the incident remain unclear. At this time, there is no concrete detail regarding the nature of the leaked or threatened data in the provided screenshots or the registration information. Furthermore, the content of the screenshots does not provide information about the types of data involved.

The listing names no specific data types that have been compromised or are being held for ransom.

About IGT

IGT (International Game Technology) is a leading gaming technology company that provides lottery, casino games, and digital gaming solutions worldwide. The company develops gaming machines and systems for both land-based and online platforms.

Risk assessment and potential implications

This announcement by the Qilin group may pose risks to the organization's operational continuity. If the data is leaked, secondary risks such as identity theft or targeted phishing attacks against the organization's customers and employees may be observed. Such secondary attacks often follow a breach, as stolen credentials or personal information can be used to conduct highly convincing social engineering campaigns.

As the organization is based in the United States, a potential data breach could trigger notification obligations under relevant state laws and federal regulations. Organizations operating in highly regulated sectors must navigate complex legal landscapes when a breach occurs, ensuring that all required reporting timelines and disclosure requirements are met to avoid further legal exposure.

The group's double-extortion tactic aims to pressure the organization into paying a ransom; however, this situation may have long-term effects on the confidentiality and security of corporate data. Even if a ransom is not paid, the exposure of internal information can lead to a loss of intellectual property or sensitive corporate intelligence, which can impact the organization's competitive standing and security posture for an extended period.

For organizations in the technology and gaming sectors, maintaining robust security frameworks is essential. This includes implementing zero-trust architectures, ensuring rigorous patch management, and conducting regular incident response drills. Protecting sensitive data through encryption and implementing strict access controls can mitigate the impact of a potential breach and reduce the effectiveness of extortion attempts by limiting the amount of usable data available to attackers.