Qilin ransomware group lists Asefa Insuarance on its leak site

• Ransomware group: Qilin
• Country: Spain
• Sector: Financial Services
• Announcement date: June 11, 2025

Qilin ransomware group targets Asefa Insurance

The Qilin ransomware group has officially listed the Spanish insurance provider Asefa Insurance on its dedicated leak site. According to an announcement published by the threat actors on June 11, 2025, the group claims to have successfully breached the institution's systems. This development follows a claimed initial access date of May 20, 2025, suggesting that the threat actors may have maintained presence within the network for several weeks prior to the public announcement.

The threat actors claim to have obtained sensitive data during their intrusion. While the specific volume of stolen files and the exact amount of the ransom demand have not been disclosed by the group, the nature of the announcement suggests a high-stakes situation. The group appears to be employing double extortion tactics, a common method used by modern ransomware operations where stolen data is used as leverage to coerce the victim into paying a ransom.

Claims of data exfiltration and affected information

The announcement on the Qilin leak site includes visual evidence intended to validate the group's claims. Screenshots provided by the attackers reportedly display various document samples that were allegedly exfiltrated from the organization's infrastructure. These samples serve as proof of the breach to pressure the victim during the negotiation process.

Based on the evidence presented by the group, the following types of information are claimed to have been compromised:

• Identity information
• Financial documents
• Customer data
• Contracts

The presence of such diverse documentation, ranging from identification cards to complex legal contracts, indicates a broad reach into the organization's internal databases and file servers.

About Asefa Insurance

Asefa Seguros is a prominent Spanish insurance company that was established in 1972. The organization specializes in providing insurance solutions specifically tailored to the construction and civil works sectors. As a member of the French SMABTP group, Asefa Insurance provides specialized insurance products designed to meet the unique requirements and risks faced by professionals within the construction industry.

Potential risks and industry implications

The alleged leak of sensitive information poses significant risks to both the institution and the individuals involved. For the customers and employees of Asefa Insurance, the exposure of identity information and financial documents increases the risk of identity theft and highly targeted phishing attacks. Such attacks often leverage specific details found in stolen contracts or customer data to gain further trust from the victims.

From a regulatory perspective, because the institution operates within Spain, it is subject to the European Union's General Data Protection Regulation (GDPR). This means the organization may face strict legal obligations regarding data breach notifications to both regulators and the affected data subjects. Furthermore, the use of double extortion by the Qilin group can lead to lasting reputational damage if the exfiltrated data is released publicly.

The Qilin group is known to operate as a Ransomware-as-a-Service (RaaS) structure and has been active since 2022, targeting a wide array of sectors, including healthcare. For organizations in the financial and insurance services sector, such incidents often necessitate rigorous audits of existing data security processes and defensive frameworks to mitigate future risks of unauthorized access and data exfiltration.