Qilin ransomware group lists cobbcounty on its leak site
The Qilin ransomware group claims to have leaked data belonging to Cobb County, located in the U.S. state of Georgia.
- Published
- 2 min read
- 2 min read
- Ransomware group: Qilin
- Country: United States
- Sector: Government & Defense
- Announcement date: May 1, 2025
Qilin claims data breach against Cobb County
The threat actor known as Qilin has announced on its leak site that it has targeted Cobb County, a public institution located in the United States. According to the announcement made on May 1, 2025, the group claims to have successfully exfiltrated a significant volume of data belonging to the organization.
The group's post indicates that the attack occurred on the same day the announcement was made. While the group has claimed responsibility for the incident, the specific details regarding the method of entry or the exact nature of the breach remain undisclosed in the public announcement.
Details of the claimed data theft
The Qilin ransomware group claims to have obtained a massive amount of information during the operation. The group asserts that the stolen data consists of more than 400,000 files, totaling a volume of more than 150 GB. To support their claims, the threat actors shared screenshots in their post that display samples of various documents.
Based on the information provided by the group, the stolen data includes several sensitive categories. The listing identifies the following types of affected data:
- Active Directory data
- Corporate documents
- Identity information
The screenshots provided by the group appear to show samples resembling identity documents and corporate records, reinforcing the claim that the stolen information contains sensitive organizational and personal files.
About Cobb County
Cobb County is an administrative county located in the U.S. state of Georgia and is part of the Atlanta metropolitan area. It functions as a public institution that provides various local government services to its residents.
Potential impact and security implications
This incident may lead to the exposure of personal data belonging to Cobb County employees and citizens. Given the institution's government status, the leak could potentially cause operational disruptions in public services. Furthermore, the institution may face data breach notification obligations under U.S. state laws and federal regulations.
The Qilin group utilizes a double-extortion method, a tactic where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. This method may increase secondary risks such as identity theft or targeted phishing attacks following the publication of the data. This tactic is designed to pressure the victim into paying the ransom by threatening to release sensitive information to the public.
Considering that the Qilin group has been active since 2022 and targets various sectors, the institution may need to re-evaluate its security infrastructure. For organizations in the government and defense sector, maintaining robust security postures is critical to defending against such persistent threats. Common defensive measures for organizations facing these types of risks include implementing strict access controls, maintaining regular backups, and conducting comprehensive security audits to identify vulnerabilities before they can be exploited by threat actors.