Qilin ransomware group lists IREM companies on leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Professional Services
• Announcement date: October 23, 2025

The Qilin ransomware group has officially listed IREM companies on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated sensitive data belonging to the organization.

The claimed ransomware attack

The incident was announced on October 23, 2025, when the Qilin group listed IREM companies on their leak site. The group claims to have gained unauthorized access to the organization's internal systems, allowing them to access and potentially steal various categories of sensitive information.

By threatening to publish the alleged stolen data, the group is employing a double-extortion tactic. In such schemes, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. The goal of this method is to increase the pressure on the victim organization by threatening to release private data to the public, which could lead to significant reputational damage, regulatory scrutiny, and legal consequences.

Details regarding the exfiltrated data

While the group claims to have acquired a variety of sensitive materials, the specific details regarding the volume of data or the exact number of files have not been provided. Furthermore, the group has not stated a specific ransom demand in the announcement. Although the group's announcement includes a screenshot intended to prove the breach, the image provided is blurred, which makes it impossible to verify or read specific file samples.

According to the claims made by the Qilin group, the following types of data are involved in the breach:

• Financial records
• Employee data
• Operational documents

About IREM companies

IREM (Institute of Real Estate Management) is an international professional organization. The entity provides education, certification, and information exchange for real estate and asset managers. Additionally, the organization conducts professional development courses in real estate management and is responsible for setting industry standards within the sector.

Implications and industry considerations

This alleged breach by the Qilin group indicates that the security of IREM companies' employees and financial assets may be at risk. Because the organization is based in the United States, the incident may trigger specific notification obligations under relevant state laws and federal regulations regarding data privacy and breach reporting.

The use of double-extortion tactics increases secondary risks for the organization and its stakeholders. If the exfiltrated data is indeed published, it could lead to identity theft and targeted phishing attacks against employees or clients. Given the established history of the Qilin group, the possibility that the exfiltrated data could be shared or sold on public platforms must be considered.

In general, organizations in the professional services sector face significant risks when targeted by ransomware groups. To mitigate such threats, industry experts often recommend robust defensive measures. These typically include maintaining rigorous backup protocols, implementing multi-factor authentication across all access points, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, maintaining a comprehensive incident response plan is essential for managing the complexities of a potential data leak and ensuring compliance with legal notification requirements.