Qilin ransomware group lists NovAtel (belongs to Hexagon) on its leak site

• Ransomware group: Qilin
• Country: Canada
• Sector: Technology
• Announcement date: November 24, 2025

Qilin ransomware group claims data breach at NovAtel

The threat actor known as Qilin has listed the Canadian technology firm NovAtel on its dedicated leak site. This announcement, made on November 24, 2025, involves an allegation of a data breach against the organization. The listing serves as a public claim by the ransomware group, signaling that they believe they have successfully compromised the company's internal systems and information.

Details of the alleged attack

According to the claim made by the Qilin group, the organization's data has been compromised. The threat actor has threatened to release the stolen information publicly if their demands are not met. This specific type of threat is a hallmark of double-extortion tactics. In such scenarios, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive data to use as leverage, threatening to leak it to damage the organization's reputation or trigger regulatory penalties.

The group's announcement includes a screenshot intended to provide proof of the breach. This image contains blurred samples that are purported to be internal documents belonging to NovAtel. However, the provided evidence does not offer a clear view of the contents. Currently, there is no clear information regarding the full scope of the incident or the specific types of data that may have been targeted or exfiltrated during the attack.

About NovAtel

NovAtel is a prominent company specializing in the development of high-precision GNSS (Global Navigation Satellite System) positioning technologies and solutions. As a subsidiary of Hexagon AB, the organization plays a critical role in the technology sector by manufacturing both hardware and software. Their solutions are utilized across a wide range of essential industries, including aerospace, defense, agriculture, and the development of autonomous vehicles.

Risk assessment and implications

The use of double-extortion tactics by groups like Qilin significantly increases the likelihood of sensitive data exposure and can lead to various secondary risks for the victimized organization. Because NovAtel is based in Canada, a confirmed data breach could trigger specific legal and regulatory requirements under local frameworks, such as the Personal Information Protection and Electronic Documents Act (PIPEDA).

Potential secondary threats

Following such a listing, organizations often face a variety of follow-on risks, including:

• Targeted phishing: Employees and business partners may become targets of sophisticated phishing campaigns using information gathered from the breach.
• Data dissemination: Given the historical activities of the Qilin group, there is a risk of wider data dissemination if the ransom is not paid.
• Reputational and regulatory impact: The severity of the situation depends heavily on the organization's position within the technology sector and the specific nature of the data involved.

For organizations operating in critical technology sectors, maintaining robust defensive postures is essential. This includes implementing strict access controls, monitoring for unauthorized data exfiltration, and ensuring comprehensive employee training to recognize social engineering attempts. As the severity of these incidents varies based on the sensitivity of the data, continuous monitoring of leak sites remains a vital part of threat intelligence efforts.