Kopas Cosmetics listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Türkiye
• Sector: Retail & E-Commerce
• Announcement date: February 4, 2026

The Qilin ransomware group has listed Kopas Cosmetics on their dedicated leak site, claiming that data belonging to the organization may be exposed. This announcement, made on February 4, 2026, suggests that a cybersecurity incident may have occurred involving the digital assets of the Turkish-based manufacturer.

The details of the claim

The threat actor known as Qilin listed Kopas Cosmetics on their leak platform on February 4, 2026. According to the group's claims, they have successfully gained access to the organization's networks and have obtained data. This allegation indicates that the group asserts they have bypassed security measures to infiltrate the corporate environment.

Ransomware groups often utilize leak sites to exert pressure on their targets. These platforms serve as a public gallery where groups post names of victims to demonstrate their success and to increase the visibility of the breach. By listing an organization, the threat actor aims to damage the victim's reputation and create urgency during the negotiation process. Such tactics are a central component of modern cyber extortion campaigns.

Information regarding the alleged leaked data

Regarding the specific nature or content of the alleged leaked data, there is no specific information provided in the available record or screenshots. The listing does not specify the types of files or the volume of information that the group claims to have stolen.

• No specific data types were named in the listing.

In many ransomware incidents, the specific contents of a breach remain unknown to the public until the threat actor chooses to release them or until the victim conducts a thorough forensic investigation. The lack of immediate detail regarding the data content is a common occurrence in the early stages of a leak site announcement.

About Kopas Cosmetics

Kopas Cosmetics is a Turkey-based manufacturer of personal care and cosmetic products. The company owns well-known brands such as Arko, Evy Baby, and Duru, and operates both in the domestic market and internationally with a wide range of products.

Implications and industry risks

This situation may trigger data breach notification obligations under the KVKK for the organization. Given the Qilin group's double-extortion methodology, the potential publication of stolen data could lead to the misuse of customer and employee information. Double extortion is a technique where attackers not only encrypt an organization's data but also steal it, threatening to leak it publicly unless a ransom is paid. This method significantly increases the pressure on the victim, as the threat of data exposure remains even if systems are restored from backups.

Risks such as identity theft or targeted phishing campaigns may emerge for the organization's supply chain partners and customers. When personal or corporate information is compromised, it can be used by malicious actors to conduct highly convincing social engineering attacks. These attacks often target specific individuals within a supply chain to gain further access to interconnected networks.

The group's past activities suggest that such incidents may exert pressure on financial and operational continuity. For organizations in the retail and e-commerce sectors, maintaining operational uptime is critical for managing customer transactions and supply chain logistics. A significant cyber incident can disrupt these processes, leading to potential financial losses and operational challenges. Organizations facing such threats often focus on strengthening their incident response plans and enhancing their monitoring capabilities to detect unauthorized network access more effectively.