Qilin ransomware group lists TEPAS on leak site

• Ransomware group: Qilin
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: March 30, 2025

Qilin ransomware group targets TEPAS

The threat actor known as Qilin has published an announcement on its leak site regarding the Norway-based company TEPAS. According to the claim made by the group, the organization has been targeted in a data breach incident. This development follows a pattern observed in modern cyberattacks where threat actors utilize dedicated leak sites to pressure victims into meeting their demands.

Ransomware leak sites serve as a platform for cybercriminals to host stolen information, often using the threat of public exposure to coerce organizations into paying ransoms. This tactic is a central component of modern extortion strategies, where the goal is not just to encrypt local systems, but to weaponize sensitive information to maximize leverage over the victim.

Details of the claim

The announcement regarding TEPAS was published by the Qilin group on March 30, 2025. In the communication, the threat actor stated that they have provided the organization with a 48-hour window to establish contact. The group has indicated that if no communication is established within this specific timeframe, the alleged data will be published on their platform.

This type of ultimatum is a common characteristic of ransomware operations. By setting a strict deadline, attackers attempt to create a sense of urgency and panic within the target organization's leadership. Such time-sensitive pressure is designed to bypass standard corporate decision-making processes and force a rapid response to the extortion attempt.

Data involvement and scope

Regarding the specific nature of the information involved in this incident, the provided records and screenshots do not contain specific information regarding the nature of the alleged leaked data. The listing does not specify the types of files, the volume of data, or the total number of files that have been targeted by the group.

In many ransomware incidents, the specific contents of a breach remain unknown to the public until the attackers decide to release them. This lack of immediate information can create significant uncertainty for the affected organization as they attempt to assess the potential impact on their operations and regulatory standing.

About TEPAS

Tepas AS is a corporate group based in Trysil, Norway. The organization operates through various subsidiaries that provide a wide range of services and industrial capabilities. Their business portfolio includes industrial manufacturing, professional competence training, snow systems, and cleaning services.

Assessment and potential implications

As Qilin is a threat actor known for employing double-extortion tactics, it is assessed that this incident may lead to operational disruptions for the organization. Double extortion involves two distinct layers of pressure: the encryption of systems to halt business operations and the theft of data to threaten public disclosure. This combination significantly increases the complexity of the incident response process.

Given that the company is based in Norway, a potential data breach could result in legal and administrative consequences under the GDPR. The General Data Protection Regulation imposes strict requirements on how organizations handle personal data and mandates specific notification procedures in the event of a breach. Failure to comply with these regulations can lead to significant regulatory scrutiny and fines.

Secondary risks associated with this claim include the potential use of leaked data for identity theft or targeted phishing attacks. When sensitive corporate or personal information is exposed, it can be repurposed by other malicious actors to conduct more sophisticated social engineering campaigns. Furthermore, considering the group's past activities, it is possible that the organization's supply chain partners could also be indirectly affected by this breach.

In the manufacturing and services sectors, organizations can mitigate these risks by implementing robust security frameworks. Common defensive steps include maintaining offline backups, enforcing multi-factor authentication across all services, and conducting regular security awareness training for employees. Additionally, maintaining a comprehensive incident response plan is essential for managing the operational and legal complexities that arise during a ransomware event.