Pangea listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Chile
• Sector: Hospitality
• Announcement date: October 15, 2025

The travel agency Pangea has been listed on the leak site of the Qilin ransomware group. According to an announcement published on October 15, 2025, the threat actor group claims to have gained access to the digital assets of the organization, alleging that a data breach has occurred.

The claims made by Qilin

The Qilin ransomware group has officially listed Pangea on its dedicated leak site. In the announcement, the group alleges that they have successfully breached the organization's digital infrastructure. This claim was made public on October 15, 2025, the same date the group claims the attack took place. While the listing confirms the group's intent to publicize the incident, the specific details regarding the method of entry or the exact timing of the access remain undisclosed by the attackers.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By listing an organization, these groups aim to damage the victim's reputation and create urgency through the threat of public exposure. This tactic is a central component of modern cyber extortion campaigns.

Details regarding the alleged data breach

Regarding the specifics of the incident, the listing provides limited information. There is no specific information provided on the leak site regarding the nature or volume of the data allegedly compromised. The announcement does not specify the number of files involved or the total size of the data set. Furthermore, no ransom demand has been made public in the current listing.

The listing names no specific data types that have been compromised.

About Pangea

Pangea is a boutique travel agency based in Chile. The organization specializes in designing bespoke, personalized travel itineraries for its clientele. Pangea operates through a multi-channel service model, providing travel services through an online platform as well as through physical flagship stores. This physical presence allows the agency to offer face-to-face consultations to its customers, integrating digital and traditional service methods.

Analysis and implications for the sector

As a threat actor known for double-extortion tactics, the Qilin group may be threatening to publish the organization's sensitive data. Double extortion is a strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. The threat of leaking such data is used to coerce the victim into paying a ransom to prevent the public release of information.

This situation could pose a risk of exposing customers' personal information. Given that the organization is based in Chile, a potential data breach may lead to legal proceedings under local data protection regulations. Organizations in the hospitality and travel sector must remain vigilant, as the compromised data could be utilized for identity theft or targeted phishing attacks against customers. The group's past activities suggest that they target similar-sized organizations to demand ransom.

To mitigate such risks, organizations in the hospitality sector can implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication across all digital assets, and conducting regular security awareness training for employees. Furthermore, monitoring for unauthorized access to sensitive databases and maintaining a clear incident response plan are essential steps in defending against sophisticated ransomware groups like Qilin.