Krusell listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Thailand
• Sector: Technology
• Announcement date: July 21, 2025

Qilin ransomware group claims attack on Krusell

The Qilin ransomware group has officially listed the Thailand-based organization Krusell on its dedicated leak site. According to the announcement made on July 21, 2025, the threat actors claim to have successfully breached the company's systems. This incident is being presented by the group as a data breach, signaling a significant security event for the manufacturer.

The threat actors allege that they gained unauthorized access to the company's internal systems during an incident that occurred on July 21, 2025. In line with modern ransomware trends, the Qilin group is employing double extortion tactics. This method involves not only encrypting a victim's data to disrupt operations but also stealing sensitive information to use as leverage. By threatening to release the stolen data publicly, the group aims to pressure the organization into paying a ransom to prevent the leak.

Data and documentation involved in the claim

While the specific volume of stolen data and the exact amount of the ransom demand have not been disclosed by the group, the leak site provides evidence of the breach. The group has shared screenshots intended to demonstrate the scope of the theft. These visual samples appear to represent various internal documents belonging to the company's business processes. The information identified in the claim includes:

• Financial statements
• Operational documents
• Business documents

The presence of such documents in a leak site suggests that the threat actors have targeted the core administrative and financial functions of the organization. The exposure of these files can lead to various downstream risks for the victimized entity.

About Krusell

Krusell is a manufacturer located in Thailand that specializes in the production of sustainable leather goods. The company's product line includes handmade handbags, belts, and a variety of other accessories. Their business model is centered around bespoke product design, a process that seeks to blend traditional craftsmanship with modern aesthetics to serve their market.

Potential impact and security implications

The Qilin (Agenda) group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2022. Their use of double extortion is a hallmark of sophisticated cybercriminal operations. For an organization like Krusell, the leak of proprietary data poses significant risks, particularly regarding the potential exposure of trade secrets and sensitive customer information. Such a breach can lead to a loss of competitive advantage and damage the brand's reputation.

Beyond the immediate impact on the company's reputation, there are several secondary risks to consider. The leaked data could be utilized by malicious actors for identity theft or as a foundation for secondary attacks. Furthermore, the exposure of business and operational documents can facilitate supply chain attacks, where attackers use the stolen information to target the company's partners or clients. The organization may also face legal obligations and regulatory scrutiny under the data protection laws applicable in Thailand.

In general, when organizations face such threats, maintaining operational continuity becomes a primary concern. To mitigate the risks associated with ransomware and data exfiltration, entities in the manufacturing and technology sectors often focus on robust defensive measures. These include implementing strict access controls, maintaining offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized access early. The impact of such an event can be felt across the entire operational lifecycle, from production to customer relations.