Mae Krathing Power Company listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Thailand
• Sector: Energy & Utilities
• Announcement date: November 20, 2025

Qilin claims to have targeted Mae Krathing Power Company

The threat actor known as Qilin has listed the Mae Krathing Power Company on its dedicated leak site. This announcement, made on November 20, 2025, indicates that the group claims to have successfully obtained sensitive information belonging to the organization. This type of public listing is a hallmark of modern ransomware operations, where groups use the threat of data exposure to exert pressure on their targets.

The announcement is categorized as a data breach notification by the group. By naming the organization on a public platform, the threat actor aims to damage the company's reputation and create urgency. This tactic is often a component of double extortion, a method where attackers not only encrypt an organization's systems but also threaten to release stolen data to force a ransom payment.

Details of the alleged data theft

According to the claims made by the Qilin group, the breach involves a significant volume of information. The group asserts that they have acquired a substantial amount of data, which they intend to use as leverage. The specifics of the alleged theft include the following details:

• Total claimed data size: 60.4 GB
• Total claimed file count: 22,888 files

While the group has provided the volume and the quantity of files, the specific nature of the allegedly leaked data is not detailed in the provided information. It remains unknown exactly what types of files or specific corporate secrets are contained within the 22,888 files mentioned by the attackers.

About Mae Krathing Power Company

Mae Krathing Power Company is a Thailand-based energy generation company. The organization operates within the renewable energy sector, with a specific focus on hydroelectric power projects. As an entity involved in energy production, the company plays a role in the regional utility infrastructure.

Analysis and potential impact of the incident

Qilin is recognized as a ransomware-as-a-service (RaaS) group that has been active since 2022. The group is known for utilizing double extortion tactics to maximize their leverage over victims. In this specific instance, the announcement may be interpreted as an attempt by the group to increase pressure on the organization through these tactics.

Given the company's operations in the energy sector, this incident may pose risks to critical infrastructure security and operational continuity. The potential publication of the data could lead to secondary risks such as identity theft or targeted phishing attacks against employees and business partners. Furthermore, the organization may face legal obligations under Thai data protection regulations following such an event. The group's history suggests that the leak could have long-term negative impacts on the company's corporate reputation.

In general, organizations in the energy and utilities sector often face heightened risks due to the critical nature of their services. To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust backup solutions to ensure operational continuity and strict access controls to limit the movement of attackers within a network. Additionally, monitoring for unauthorized data exfiltration and maintaining a strong incident response plan are standard defensive measures used to mitigate the impact of ransomware and data breaches.