Qilin ransomware group claims data breach at gettys.com

• Ransomware group: Qilin
• Country: United States
• Sector: Hospitality
• Announcement date: March 25, 2025

Qilin ransomware group targets gettys.com

The threat actor known as Qilin has officially listed the organization gettys.com on its dedicated leak site. According to the announcement made on March 25, 2025, the group claims to have successfully accessed the data belonging to the organization. This development follows a period of alleged unauthorized access that the group claims began on February 28, 2025.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By publicly naming an organization, these groups aim to damage the victim's reputation and force a ransom payment. This specific incident highlights the ongoing threat posed by sophisticated ransomware operations that target international firms across various sectors.

Details of the claimed attack

The Qilin group, which has also been referred to as Agenda, has provided evidence to support its claims regarding the breach of gettys.com. The group has published several document samples that they claim were obtained directly from the organization's internal systems. These samples are intended to demonstrate the validity of their access and to increase the pressure on the target organization.

The group is utilizing a tactic known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public forum provides the attackers with additional leverage during ransom negotiations, as the victim faces the risk of public exposure and regulatory scrutiny.

Claimed data and evidence

The evidence provided by the threat actor includes screenshots containing various document samples. These samples are claimed to be part of the organization's internal communications and operational data. However, the specific details of the documents are obscured, as the screenshots contain blurred content. The listing does not specify the total volume of data stolen or the exact number of files involved.

• Internal communications
• Operational data

About the Gettys Group

The Gettys Group is an international firm that provides a specialized range of services to the hospitality industry. For over 30 years, the organization has focused on interior design and brand strategy for hotel developers and operators. Their expertise spans design, procurement, and development services, making them a significant player in the global hospitality sector.

Potential impact and industry implications

The actions taken by the Qilin group could have significant negative impacts on the business operations and the level of customer trust held by the organization. Depending on the specific nature of the data that has been claimed to be leaked, the organization may face various legal obligations under United States state laws and relevant data protection regulations.

Furthermore, the use of the double-extortion method introduces secondary risks. If the stolen data is published or sold on the dark web, it could lead to identity theft or targeted phishing attacks aimed at the organization's employees and business partners. Such attacks often leverage the stolen information to appear legitimate, making them harder to detect.

The Qilin group has demonstrated a broad operational capacity, having been active since 2022. Their history shows they target a wide range of sectors, including healthcare, which indicates a high level of versatility in their targeting strategies. For organizations in the hospitality and service sectors, maintaining robust cybersecurity defenses is essential to mitigate the risks of data exfiltration and the subsequent reputational and legal consequences.

General defensive considerations

To defend against such threats, organizations typically implement multi-layered security strategies. This includes maintaining regular, offline backups to ensure data can be restored without paying a ransom, and implementing strict access controls to limit the movement of attackers within a network. Monitoring for unusual data exfiltration patterns can also help in detecting a breach before the double-extortion phase is completed.