Qilin ransomware group claims data leak from Sinari's software POC

• Ransomware group: Qilin
• Country: France
• Sector: Technology
• Announcement date: April 4, 2025

The Qilin ransomware group has announced that it has successfully compromised and leaked data belonging to Sinari's software POC. This claim, which was published on the group's dedicated leak site on April 4, 2025, suggests a significant breach targeting the organization's digital assets and sensitive information.

The details of the claim

According to the announcement made by the threat actor known as Qilin, the group claims to have gained unauthorized access to data from Sinari's software POC. The group has stated that they attempted to engage in negotiations with the management of the organization regarding the protection of their data. However, the group reports that these negotiations were unsuccessful, and they were unable to reach an agreement with the company's leadership. This failure to reach a settlement appears to have prompted the group to move forward with the publication of their claims on their leak site.

The timeline provided by the threat actor suggests that the alleged attack occurred on March 17, 2025, approximately two weeks before the public announcement was made on their leak site. While the group has made these claims, it is important to note that the specific volume of data and the exact number of files involved have not been disclosed by the attackers. Furthermore, no specific ransom demand has been mentioned in the public announcement regarding this specific incident.

The alleged data involved

The Qilin group claims that the leaked information is extensive and covers several critical categories of organizational data. The group has shared screenshots to support their claims; however, these images appear to be blurred, which makes it impossible to verify the specific content or the authenticity of the files shown. Based on the group's announcement, the data allegedly stolen includes the following types of information:

• Software development data
• Personal data
• Customer data
• Internal data
• Source codes

The inclusion of source codes and software development files is particularly significant in a breach of this nature, as it targets the core intellectual property of a technology-driven organization.

About Sinari's software POC

Sinari is a technology company based in France. The organization specializes in the development of software solutions specifically designed for the logistics and transport sector. Their primary focus involves providing specialized software intended for transport management and the optimization of various logistics operations. Given their role in the logistics and transport industry, the organization plays a vital part in the technical infrastructure of its sector.

Analysis and potential implications

The claims made by the Qilin group pose several significant risks to the organization. If these claims are verified, the exposure of source codes and software development files could potentially lead to the discovery of new vulnerabilities within the organization's software products. This, in turn, could increase supply chain risks for the company's clients who rely on these software solutions. Furthermore, the exposure of personal and customer data presents a direct threat to customer privacy and the organization's intellectual property.

Because Sinari is based in France, any confirmed breach involving personal data could lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). The group involved, Qilin, is known for employing double extortion tactics. In such scenarios, threat actors do not just encrypt data to disrupt operations, but they also steal sensitive information to use as leverage, threatening to leak it if the ransom is not paid. This stolen data can be utilized for secondary attacks or highly targeted phishing campaigns against the organization or its clients.

To defend against such threats, organizations in the technology and logistics sectors often implement various defensive measures. These include robust encryption for data at rest and in transit, strict access controls to protect source code repositories, and continuous monitoring of network activities to detect unauthorized access. Additionally, maintaining a strong incident response plan and conducting regular security audits are essential steps for mitigating the impact of potential breaches and ensuring compliance with regional data protection regulations.