Qilin ransomware group claims data breach at HEXPOL COMPOUNDING AMERICAS

• Ransomware group: Qilin
• Country: United States
• Sector: Manufacturing
• Announcement date: January 31, 2025

Qilin claims data exfiltration against HEXPOL COMPOUNDING AMERICAS

The Qilin ransomware group has officially claimed responsibility for a data breach targeting HEXPOL COMPOUNDING AMERICAS. According to an announcement posted on a ransomware leak site on January 31, 2025, the threat actor alleges that they have successfully exfiltrated sensitive information belonging to the organization. This claim follows an alleged incident that took place on December 15, 2024.

The group's announcement suggests that the breach was made possible by exploiting vulnerabilities within the organization's IT infrastructure. By leveraging these weaknesses, the attackers claim to have gained access to various internal departments, allowing them to extract a wide range of corporate and operational data. While the group has provided screenshots as evidence, these images contain only blurred document samples, making it impossible to verify the exact contents or the full scope of the stolen information at this time.

Details of the alleged data theft

The Qilin group has specified that the stolen information spans multiple critical business functions. The data allegedly taken from the organization's systems includes documentation from several key departments, potentially compromising both administrative and highly technical operational secrets. The specific categories of data claimed to have been exfiltrated include:

• Financial data
• HR data
• Engineering data
• Logistics data
• Production data
• Purchasing data
• Safety data
• Product recipes

The inclusion of product recipes and engineering data is particularly significant for a company in the manufacturing sector, as these often constitute the core intellectual property of the business. The breadth of the claimed theft suggests an extensive intrusion into the company's digital environment.

About HEXPOL COMPOUNDING AMERICAS

HEXPOL COMPOUNDING AMERICAS is a manufacturing company that specializes in the production of polymer compounds and rubber solutions. As a member of the HEXPOL Group, the company serves a diverse array of industrial sectors, providing essential materials for the automotive, construction, and energy industries. Given its role in these critical supply chains, the company's operational data is vital to its industrial functions.

Analysis and potential implications of the attack

The Qilin group is known for employing double extortion tactics. In such scenarios, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data beforehand. The group then uses the threat of leaking this information on public sites to exert maximum pressure on the organization to pay a ransom. This method significantly increases the risk to the victim, as the breach persists even if systems are restored from backups.

For an organization like HEXPOL COMPOUNDING AMERICAS, the exposure of such data carries several heavy risks. The theft of engineering and production data, including specific product recipes, poses long-term commercial risks that could impact the company's competitive advantage and operational continuity. Furthermore, the exposure of HR and financial data increases the risk of identity theft or targeted phishing attacks directed at the organization's employees and business partners.

Because the organization is based in the United States, this incident may trigger various legal obligations under federal regulations and specific state laws, depending on the exact nature and sensitivity of the leaked data. Additionally, the group's history of activity suggests that attacks of this nature can create secondary impacts throughout the broader supply chain. Organizations in the manufacturing sector can mitigate such risks by implementing robust security frameworks, such as zero-trust architectures, ensuring rigorous patch management to close infrastructure vulnerabilities, and maintaining strict access controls to protect intellectual property like recipes and engineering designs.