Qilin ransomware group lists upstartpower.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Technology
• Announcement date: June 12, 2025

Qilin ransomware group claims data breach at Upstart Power

The Qilin ransomware group has published an announcement on its leak site, claiming to have leaked data belonging to upstartpower.com. This development follows a pattern of extortion where threat actors target specific organizations to pressure them into meeting demands by threatening the release of sensitive information.

According to the announcement discovered on June 12, 2025, the group has listed the company on its leak site. The group has reportedly set a deadline, stating that the company's data would be released on June 23, 2025. While the announcement was made in mid-June, the group claims the alleged attack occurred on June 3, 2025. The group has shared text that references the company's operations and various corporate documents, supplemented by several screenshots intended to prove the validity of the breach.

Details of the alleged data leak

The information shared by the Qilin group in their announcement includes visual evidence of the stolen material. The screenshots provided in the leak site post contain examples of various sensitive documents. Based on the available information, the following types of data are said to be involved in the breach:

• Corporate correspondence
• Contracts
• Official government correspondence

The presence of such documents suggests that the attackers have gained access to internal communications and legal agreements. It is important to note that no specific information was provided regarding the total size of the data stolen or the total file count. Additionally, no ransom demand has been publicly disclosed by the group in the provided source.

About Upstart Power

Upstart Power is an energy technology company that focuses on the design and manufacture of solid oxide fuel cell (SOFC) generators. Since its founding in 2018, the company has focused on the development of energy solutions that aim to be both reliable and efficient.

Analysis and potential organizational risks

This alleged leak by the Qilin group may pose a significant risk to the company's operational confidentiality. Given the nature of the shared documents, there is a possibility that the company's trade secrets and legal processes could become accessible to third parties. Because the company is a US-based entity, the incident may have implications regarding state-level data protection regulations and potential legal liabilities.

The group appears to be employing double extortion tactics. In these types of attacks, threat actors not only encrypt a victim's systems but also steal sensitive data to use as leverage. If the data is released, it could increase secondary risks such as reputational damage and the likelihood of targeted phishing attacks against the organization or its partners. Publicly available information regarding this specific group remains limited.

For organizations operating in the technology and energy sectors, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing strict access controls, maintaining offline backups, and conducting regular security audits. Protecting against double extortion requires a multi-layered approach to data loss prevention and continuous monitoring of network traffic to detect unauthorized data exfiltration before it can be used for extortion.