Qilin ransomware group lists dalton.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Manufacturing
• Announcement date: October 16, 2025

Qilin ransomware group claims data breach at Dalton Pharma Services

The Qilin ransomware group has published an announcement on its dedicated leak site claiming to have compromised the systems of Dalton Pharma Services. According to the threat actor, the organization's data has been exfiltrated and is being made available to the public. This announcement, posted on October 16, 2025, marks a significant escalation in the pressure placed upon the target organization through the use of public disclosure.

The incident is characterized by the threat actor's use of double-extortion tactics. In such scenarios, ransomware groups do not merely encrypt an organization's local files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data on a public leak site, the attackers aim to coerce the victim into paying a ransom to prevent the exposure of confidential information. This method increases the psychological and reputational pressure on the target, as the threat of a public leak can damage trust with clients, partners, and regulatory bodies.

Details of the alleged data leak

The Qilin group claims to have obtained various documents from the organization's internal systems. The group has made these files available publicly to demonstrate the success of their intrusion. While the specific volume of data or the exact number of files stolen have not been disclosed by the group, the nature of the documents mentioned suggests a significant breach of corporate and operational information.

The announcement indicates that the following types of documents are included in the leak:

• Bank statements
• Service agreements
• Laboratory reports

The presence of such documents suggests that the breach may have touched upon sensitive financial, legal, and technical data essential to the company's day-to-day operations and scientific research.

About Dalton Pharma Services

Dalton Pharma Services is a contract development and manufacturing organization (CDMO) that operates within the pharmaceutical and biotechnology sectors. Founded in 1986, the company provides a wide array of services, including drug development, manufacturing, and analytical services. Their capabilities span the entire lifecycle of pharmaceutical products, offering comprehensive solutions that range from the initial preclinical stages through to full-scale commercial manufacturing.

Implications and industry risks

The alleged leak of these documents suggests that the organization's financial and operational data may be at risk. Such an exposure can lead to the disclosure of trade secrets, which are vital to a CDMO's competitive advantage. Furthermore, the breach could have negative impacts on the company's supply chain partners, who may rely on the confidentiality of the information shared during service agreements and laboratory testing.

Because Dalton Pharma Services is a United States-based entity, this breach may result in legal consequences under relevant state laws and federal data protection regulations. Organizations operating in highly regulated sectors, such as manufacturing and pharmaceuticals, must be particularly vigilant against such threats. The Qilin group, which has been active as a Ransomware-as-a-Service (RaaS) provider since 2022, is known for these double-extortion methods, which can leave organizations vulnerable to secondary attacks or identity theft attempts following the initial breach.

To mitigate the risks associated with such attacks, organizations in this sector often focus on strengthening their defensive posture. This includes implementing robust data encryption, maintaining strict access controls, and ensuring comprehensive logging and monitoring of network activities. Additionally, maintaining a rigorous incident response plan and conducting regular security awareness training can help organizations detect and respond to unauthorized access attempts more effectively, potentially preventing the exfiltration of sensitive data before it reaches a leak site.