Pollex Asset Management Co. targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: South Korea
• Sector: Financial Services
• Announcement date: September 15, 2025

Qilin ransomware group claims data breach at Pollex Asset Management Co.

The threat actor known as Qilin has listed Pollex Asset Management Co. on its dedicated leak site, claiming to have successfully exfiltrated sensitive information from the organization. This announcement, made on September 15, 2025, follows an alleged intrusion into the company's infrastructure that reportedly occurred on September 6, 2025. The claim suggests that the group has gained unauthorized access to the firm's internal systems and has obtained a variety of sensitive records.

Details of the alleged attack

According to the claims made by the Qilin group, the threat actors managed to penetrate the infrastructure of Pollex Asset Management Co. to obtain sensitive data. In their public announcement, the group has leveled accusations against the organization, alleging that the company failed to implement adequate protections to secure the information of both its employees and its investors. This type of public shaming is a hallmark of modern ransomware operations, where the attackers use the threat of exposure to pressure the victim.

While the specific volume of the stolen data and the exact nature of the files have not been explicitly detailed in terms of size or file count, the group has provided evidence to support its claims. The leaked information is purported to include several categories of sensitive data, as evidenced by screenshots provided by the attackers. The items identified in the leak include:

• Employee identity records
• Investor identity records
• Financial documents

The presence of such sensitive information in a public leak site poses significant risks to the individuals whose data is involved, as it provides a roadmap for further malicious activities.

The implications for the financial sector

The Qilin group is recognized as a ransomware-as-a-service (RaaS) operation that has been active since 2022. This group is known for employing double-extortion tactics, a method where attackers not only encrypt the victim's data to disrupt operations but also steal the data beforehand to threaten its public release. This dual pressure is designed to maximize the likelihood of receiving a ransom payment, as the threat of a data leak can be just as damaging as the loss of access to systems.

Given that Pollex Asset Management Co. operates within the financial services sector, the potential consequences of this alleged breach are multifaceted. The leaked identity records of employees and investors could be highly valuable to other cybercriminals, potentially leading to identity theft and highly targeted phishing campaigns. Furthermore, the organization may face significant legal challenges and consequences under the data protection regulations established in South Korea.

Beyond the immediate technical and legal threats, the organization faces long-term operational and reputational risks. The loss of investor trust is a critical concern for any firm in the financial sector, and the disruption caused by such an incident can have lasting negative impacts on the firm's stability. Based on the historical attack patterns of the Qilin group, there is a possibility that the stolen data could be disseminated more widely across the internet in the future.

General defensive considerations

In response to such threats, organizations in the financial sector often focus on strengthening their defensive posture. This typically involves implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all access points, and maintaining rigorous monitoring of network traffic to detect unauthorized access early. Additionally, maintaining comprehensive backups and conducting regular incident response drills are standard practices to mitigate the impact of ransomware and data exfiltration events.