Merko Ehitus listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Estonia
• Sector: Manufacturing
• Announcement date: December 15, 2025

The Qilin ransomware group has listed the Estonian organization Merko Ehitus on its dedicated leak site, claiming that the company has suffered a data breach. This announcement, made on December 15, 2025, suggests that the organization may have been targeted in a ransomware attack aimed at compromising its digital assets.

The claimed attack event

According to the announcement posted on the Qilin leak platform, the threat actor group claims to have gained unauthorized access to the digital assets belonging to Merko Ehitus. The listing appeared on December 15, 2025, which matches the date the group claims the attack occurred. While the presence of a company on a ransomware leak site is a significant indicator of a potential cyberattack, it remains a claim made by the threat actor.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often use these sites to host stolen data or to announce that a company has been breached. The listing of an organization on such a site is a common tactic used to increase the pressure on the victim to meet the attackers' demands.

Details regarding the compromised data

At this time, no specific details have been provided regarding the nature of the leaked or compromised data. The group has not disclosed the volume of data or the specific types of files that were allegedly accessed. Furthermore, the content of the screenshot provided by the group is not clearly legible, making it impossible to verify the specific contents of the breach through visual inspection.

The listing names no specific data types.

Potential risks of data exposure

When ransomware groups engage in data breaches, they frequently employ a tactic known as double extortion. In this scenario, the attackers not only encrypt the victim's systems to disrupt operations but also steal sensitive information. The threat of leaking this stolen data publicly serves as additional leverage to coerce the organization into paying the ransom. If the stolen information includes sensitive details, it can lead to significant secondary risks for the organization and its stakeholders.

Organization profile

Merko Ehitus is a leading construction and real estate development company based in Estonia. The organization provides a wide range of construction services, including residential, commercial, and infrastructure projects.

Analysis and potential implications

This situation may pose a risk to the operational continuity of Merko Ehitus. Given the known tactics of the Qilin group, there is a possibility that the organization's sensitive data could be published if their demands are not met. The group has demonstrated a historical tendency to publicly release data when organizations refuse to pay the ransom.

Because the organization is based in Estonia, this incident may have significant legal implications under the EU General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how organizations handle and protect personal data, and a breach can trigger mandatory reporting and legal scrutiny. Furthermore, if the leaked data includes employee or customer information, secondary risks such as identity theft and targeted phishing attacks may be observed. Attackers often use stolen credentials or personal details to conduct more sophisticated social engineering campaigns against individuals within the affected organization.

For organizations operating in the manufacturing and construction sectors, maintaining robust cybersecurity posture is essential to mitigate these risks. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized access early. Protecting the integrity of digital assets is vital for ensuring the ongoing stability of large-scale infrastructure and development projects.