Qilin ransomware group lists scelltech.com on its leak site

• Ransomware group: Qilin
• Country: France
• Sector: Technology
• Announcement date: May 16, 2025

Qilin ransomware group claims data breach at Scelltech

The Qilin ransomware group has announced a data leak involving scelltech.com, claiming to have obtained the company's internal data. This announcement was made via the group's dedicated leak site, marking a potential cybersecurity incident for the organization.

Details of the alleged attack

According to the announcement made on May 16, 2025, the Qilin group has listed scelltech.com on its leak site. The group claims that the stolen data will be made available for download starting May 28, 2025. To support their claims, the group has provided several visual proofs related to the company's operational activities.

Ransomware groups often use leak sites to exert pressure on their victims. These sites serve as a public stage where the attackers can showcase their success to the victim and the wider community. By setting a countdown or a specific date for data release, the threat actors aim to create a sense of urgency, hoping to force the organization into meeting their demands through public exposure.

Scope of the leaked data

The provided screenshots released by the group display various documents and operational records related to the company's activities. However, detailed information regarding the full scope and nature of the data remains unknown. The listing names no specific data types or file counts.

About Scelltech

Scelltech is a French company specializing in floor finishing, marking, signage, and pavement maintenance services. It provides services to general contractors, property managers, and municipalities.

Analysis and potential impact

The double extortion method employed by the Qilin group may negatively impact the company's operational continuity and reputation. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This dual-threat approach increases the pressure on the victim to pay, as they face both operational downtime and the risk of data exposure.

As the company operates in France, it may be subject to data protection obligations under the GDPR. Failure to protect personal data can lead to significant regulatory scrutiny and legal consequences. If the data is leaked, secondary risks such as identity theft or targeted phishing attacks against employees and customers could emerge. Such attacks often follow a breach, as criminals use the stolen information to craft highly convincing fraudulent communications.

Given that the Qilin group is a Ransomware-as-a-Service (RaaS) operation active since 2022, such announcements may be intended to exert pressure on the victim organization. RaaS models allow developers to lease their malware to affiliates, who then carry out the actual attacks, often leading to a high volume of diverse targets. Organizations facing such threats typically focus on robust backup strategies, network segmentation, and continuous monitoring to mitigate the impact of a potential intrusion.