Qilin ransomware group lists kanzlei-schramm.com on its leak site

• Ransomware group: Qilin
• Country: Germany
• Sector: Professional Services
• Announcement date: October 6, 2025

The Qilin ransomware group has claimed responsibility for a data breach involving kanzlei-schramm.com, a professional services firm based in Germany. According to an announcement made on the group's leak site on October 6, 2025, the threat actor group alleges they have successfully exfiltrated and published sensitive information belonging to the organization.

Details of the claimed attack

According to the claims made by the Qilin group, the incident that led to the data exposure occurred on October 4, 2025. The group has officially listed kanzlei-schramm.com on its dedicated leak site to pressure the organization. In their public announcement, the group did not limit themselves to technical claims, as the post included various critical statements regarding the operations of the firm and its founder, Markus Schramm.

Ransomware groups often utilize leak sites as a primary component of their extortion strategy. These platforms serve as a public stage where attackers can demonstrate the success of their intrusions. By publishing information, the group aims to increase pressure on the victim to meet their demands. This tactic is a hallmark of modern cyber extortion, where the threat of public exposure is used as leverage alongside the encryption of local systems.

Data involved in the leak

The group has published several documents that they claim belong to the firm. Based on the available information, the screenshots provided by the attackers display various document samples that appear to be related to legal and tax consultancy processes. However, a detailed list regarding the full scope and nature of the leaked data has not been provided by the threat actors.

The listing names no specific data types or a comprehensive inventory of the stolen files. Because the group has not provided a granular breakdown of the information, the exact volume and specific categories of the compromised data remain unconfirmed. In such scenarios, the lack of transparency from the attacker makes it difficult for the victim to immediately assess the full extent of the exposure.

The organization profile

Kanzlei Schramm is a law and tax consultancy firm based in Germany. The firm is managed by Markus Schramm and provides professional services in the fields of legal counsel and tax advisory.

Implications and security considerations

The claim of a data leak poses significant risks regarding client confidentiality for a firm operating in the legal and tax consultancy sector. Because the firm is based in Germany, the verification of the leak could lead to legal processes and administrative sanctions under the General Data Protection Regulation (GDPR). The sensitive nature of legal and tax documentation means that any confirmed exposure could have long-lasting consequences for the firm's reputation and its regulatory standing.

Given the Qilin group's known use of the double-extortion method, there is a high possibility that the leaked data could be utilized for identity theft or targeted phishing attacks. In a double-extortion scenario, attackers not only encrypt a victim's data but also steal it, threatening to release it to the public if the ransom is not paid. This method is particularly effective against professional service providers who handle highly sensitive client information.

Furthermore, because the firm provides essential professional services, the leak may have negative implications for supply chain security. When a service provider is compromised, the breach can potentially impact the security posture of their clients. Organizations in this sector can take defensive steps such as implementing strict access controls, enhancing monitoring for unauthorized data exfiltration, and maintaining robust encryption for data at rest and in transit to mitigate these types of risks.