KHL Printing listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Singapore
• Sector: Manufacturing
• Announcement date: October 22, 2025

Qilin ransomware group targets KHL Printing

The Qilin ransomware group has listed the Singapore-based manufacturing company KHL Printing on its leak site. This announcement marks a significant development in the ongoing threat landscape facing the manufacturing sector in Southeast Asia. The threat actor, known as Qilin, claims to have successfully targeted the organization, leading to a potential exposure of sensitive corporate information.

Details of the claimed attack

According to the claims made by the Qilin group, the threat actor gained access to the systems belonging to KHL Printing on October 22, 2025. The group alleges that they have published data belonging to the company on their dedicated leak site. This type of activity is a hallmark of modern ransomware operations, where the goal is not merely to encrypt files for ransom, but to use the threat of data exposure as a secondary lever for extortion.

The listing on the leak site includes samples of various documents that the group claims are related to the company's business operations and data. These samples serve as a method for the attackers to demonstrate the validity of their breach to the victim and the public. While the specific volume of data or the exact number of files involved has not been specified, the presence of these samples indicates a targeted effort to compromise the organization's digital infrastructure.

Affected data types

The group has provided evidence through screenshots that they claim contain various files. The information identified in the listing includes:

• Commercial documents
• Operational data

About KHL Printing

KHL Printing is one of the largest printing companies in Southeast Asia. The organization provides end-to-end printing solutions, covering the entire process from the initial conceptualization stage through to the final product delivery. The company offers a comprehensive range of services and specializes in the production of various print products, making it a significant player in the regional manufacturing landscape.

Implications and risks of the breach

The Qilin group is known for employing double-extortion tactics against its targets. In a double-extortion scenario, attackers first steal sensitive data and then demand a ransom to prevent that data from being leaked or published. This tactic significantly increases the pressure on the victim, as the threat of public exposure can cause irreparable harm even if the organization has robust backups for its systems.

This situation may pose a risk of sensitive corporate data being leaked or made public if a ransom is not paid. For a company operating in Singapore, such a breach may trigger specific legal obligations under the Personal Data Protection Act (PDPA). Beyond legal compliance, the data breach could lead to a loss of reputation among the company's customers and business partners. Furthermore, it is possible that the leaked data could be utilized by malicious actors for identity theft or targeted phishing attacks against the company or its stakeholders.

Organizations operating in the manufacturing sector often face similar risks due to the high value of their intellectual property and operational data. To mitigate such risks, companies typically focus on implementing multi-layered security frameworks. This includes maintaining strict access controls, implementing continuous monitoring of network traffic, and ensuring that all software and systems are regularly patched. Additionally, maintaining offline, immutable backups is a critical defensive step to ensure business continuity in the event of a ransomware incident. Regular employee training to recognize phishing attempts is also a fundamental component of a proactive cybersecurity posture.