Qilin ransomware group lists denali-industrial.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Manufacturing
• Announcement date: September 12, 2025

The Qilin ransomware group has claimed responsibility for a data breach involving Denali Industrial Supply. According to an announcement posted on a leak site on September 12, 2025, the threat actor group asserts that they have successfully exfiltrated data belonging to the organization.

The claimed attack details

The Qilin ransomware group has provided specific details regarding the timeline of their alleged intrusion. The group claims to have gained unauthorized access to the systems of denali-industrial.com on August 22, 2025. Following this initial access, the group made a public announcement on September 12, 2025, to signal their involvement in the incident.

In the announcement made on their leak site, the group included statements that directly threaten the business reputation of the organization. This type of public pressure is a common tactic used by ransomware groups to increase leverage over their targets during negotiations.

Data involved in the incident

Regarding the specific content of the allegedly leaked information, there is no clear information regarding the content of the data. The announcement does not provide details regarding the total size of the files or the specific number of files involved. Furthermore, no ransom demand has been specified in the public claim.

While the specific types of data have not been explicitly listed, the group has provided a screenshot that makes references to the organization's operational documents. This suggests that the breach may impact internal business processes and documentation.

Organization profile

Denali Industrial Supply is an Alaska-based supplier of industrial tools, fasteners, and accessories. For over 35 years, they have been distributing high-quality equipment by collaborating with various well-known industrial manufacturers.

Analysis and potential risks

As a threat actor known for double extortion, the Qilin group may be aiming to pressure the organization by publicly releasing the exfiltrated data. Double extortion is a sophisticated ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method is designed to maximize the pressure on a victim to pay the ransom, as the threat of a data leak can cause significant reputational and legal damage.

This situation could lead to the exposure of customer and employee data, which could potentially trigger legal processes under relevant US state laws and data protection regulations. Beyond the immediate legal implications, there are significant secondary risks. The leaked data could potentially be used by malicious actors for identity theft or to conduct targeted phishing attacks against the organization or its stakeholders.

Given the group's past activities, it is assessed that this incident may also pose a risk to the organization's supply chain partners. In the manufacturing sector, where companies are often deeply integrated with various suppliers and distributors, a breach in one link of the chain can create cascading risks for others. Organizations in this sector can take defensive steps such as implementing strict access controls, maintaining offline backups, and conducting regular security audits to mitigate these types of risks.

• Operational documents