Qilin ransomware group lists teamhorner.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: May 29, 2025

The Qilin ransomware group has claimed responsibility for a cyberattack against teamhorner.com, a company operating within the retail and e-commerce sector. According to an announcement made on a ransomware leak site on May 29, 2025, the threat actor group alleges to have successfully compromised data belonging to the organization.

The claimed attack and extortion tactics

The threat actor known as Qilin has officially listed teamhorner.com on its dedicated leak site. While the group has stated that the attack occurred on May 2, 2025, the timeline suggests a strategic approach to the extortion process. The group has announced that the company's data is scheduled to be made available for download on June 11, 2025.

This delay between the claimed intrusion and the scheduled leak is a characteristic move in modern ransomware operations. It is assessed that the group aims to increase pressure on the organization through its use of double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information. The threat of leaking this stolen data publicly serves as a secondary lever to coerce the victim into paying a ransom, even if the organization has robust backups to restore their systems.

Details regarding the alleged leaked data

At this stage, no specific details regarding the content of the alleged leaked data have been provided by the threat actors. Although the group has posted information on their site, the files presented in the accompanying screenshot are blurred. This makes it impossible to identify specific data types or the exact nature of the information that has been targeted. Consequently, the listing names no specific data types.

About teamhorner.com

Team Horner is an integrated manufacturer and wholesaler operating in the pool and spa industry. Founded in 1969, the company provides specialized solutions and products for the global pool and spa market. Based in the United States, the organization serves a wide range of customers through its manufacturing and wholesale operations.

Risk assessment and industry implications

The Qilin group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2022. This business model allows developers to lease their malware to affiliates, who then carry out the actual attacks, often employing double-extortion methods to maximize profit. The potential publication of the company's data may create secondary risks for employees and customers, such as identity theft or targeted phishing attacks, should the sensitive information be released.

Because the company is based in the United States, a potential data breach may trigger state-level data protection regulations and notification requirements. Organizations operating in the retail and e-commerce sectors must remain vigilant, as the publication of sensitive corporate information is a likely outcome if a ransom demand is not met. To defend against such threats, organizations typically focus on strengthening perimeter defenses, implementing multi-factor authentication, and maintaining rigorous data encryption protocols to mitigate the impact of a potential breach.