Qilin ransomware group lists www.bestop.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Manufacturing
• Announcement date: May 22, 2025

Qilin ransomware group claims attack on Bestop

The Qilin ransomware group has listed the United States-based manufacturing company www.bestop.com on its dedicated leak site. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack, raising concerns regarding potential data exposure.

The group announced that it has targeted www.bestop.com in a post published on May 22, 2025. It is alleged that activities against the organization's systems took place on May 8, 2025. Through this announcement, the group claims to have obtained the organization's data and implies that it may demand a ransom through a double-extortion strategy.

Double-extortion is a common tactic used by modern ransomware groups. In this method, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The group then threatens to leak the stolen data on public forums or leak sites if the ransom is not paid, creating additional pressure on the victim through the threat of reputational damage and regulatory scrutiny.

Data involvement and claims

Regarding the specifics of the breach, the group has not provided detailed information concerning the volume of data or the specific number of files involved. No information was provided regarding the total size of the data or the specific file count. Furthermore, no specific ransom demand has been stated by the group in the current announcement.

The content of the data shared in the screenshot provided by the group is blurred, making it impossible to identify specific data types. Consequently, the listing names no specific data types that have been compromised.

About Bestop

Bestop is an automotive aftermarket company that specializes in manufacturing soft tops, doors, and various exterior accessories, particularly for Jeep and other off-road vehicles. Founded in 1954, the company is known as one of the largest manufacturers of Jeep accessories in the industry.

Analysis and potential impact

The Qilin group is known to be a Ransomware-as-a-Service (RaaS) entity that has been active since 2022. This group is recognized for employing double-extortion tactics to maximize their leverage over victims. This situation may lead to the risk of sensitive data being leaked or made public.

As a US-based company, a potential data breach may be subject to state-level data protection laws and regulations. Such legal frameworks often require companies to follow strict protocols regarding notification and data handling following a security incident. Additionally, secondary risks such as identity theft or targeted phishing attacks may arise for the company's employees and customers if personal information is indeed compromised.

Given the group's past activities, it is foreseeable that the organization's operational continuity could be negatively impacted. When manufacturing entities face such threats, the disruption can affect supply chains and production schedules. To mitigate such risks, organizations in the manufacturing sector often focus on robust backup strategies, network segmentation, and continuous monitoring to detect unauthorized access early in the attack lifecycle.