Qilin ransomware group lists office-national on its leak site

• Ransomware group: Qilin
• Country: Australia
• Sector: Professional Services
• Announcement date: May 30, 2025

The Australian office supply network Office National has been listed on the leak site of the Qilin ransomware group. The group has published an announcement claiming to have compromised data belonging to the organization, marking a potential significant cybersecurity incident for the professional services provider.

The claimed attack and announcement

On May 30, 2025, the Qilin ransomware group published an announcement on their dedicated leak portal. This post serves as a notification regarding an alleged intervention into the digital assets of Office National. According to the group's claim, they have successfully gained access to the organization's internal data.

Ransomware leak sites function as a platform for cybercriminal groups to exert pressure on their victims. These sites are used to host announcements and, in many cases, samples of stolen data to coerce organizations into paying ransoms. In this instance, the group's post acts as a public claim of a successful breach of the organization's digital infrastructure.

Data involvement and details

Regarding the specific details of the alleged breach, the group has not provided specific information regarding the total size of the data or the total file count involved. Furthermore, there is no information available regarding a specific ransom demand or the exact nature of the files accessed.

While the group has provided screenshots as part of their announcement, the content of the data shared in these images cannot be clearly identified. The listing names no specific data types that have been compromised.

About Office National

Office National is a network of independent office supply stores operating across Australia. The company provides a wide range of solutions, including office stationery, technology equipment, and furniture solutions to its clients.

Analysis and potential risks

The Qilin group is known for employing double-extortion tactics. This specific method involves not only encrypting an organization's files to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak the stolen information on their public portal, the attackers attempt to exert maximum pressure on the victim to meet their demands.

This situation may pose a risk of exposing employee or customer data within Office National. Under Australian data protection regulations, the organization may face mandatory data breach notification requirements if the incident meets the threshold of a reportable breach. Beyond the immediate impact, secondary risks may include the use of leaked data in identity theft or targeted phishing attacks against the organization's stakeholders.

Given the group's past activities, disruptions in the organization's operational processes may be expected. In the professional services sector, such disruptions can impact supply chains and service delivery. Organizations facing such threats often focus on defensive measures such as robust backup strategies, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access early.

Summary of risks

• Potential exposure of employee or customer data
• Risk of identity theft or targeted phishing
• Potential operational disruptions
• Regulatory notification requirements under Australian law