Qilin ransomware group lists www.unitedcaps.com on its leak site

• Ransomware group: Qilin
• Country: Luxembourg
• Sector: Manufacturing
• Announcement date: April 23, 2025

The Qilin ransomware group has listed the Luxembourg-based packaging solutions manufacturer United Caps on its dedicated leak site. According to the announcement made on April 23, 2025, the threat actor group claims to have successfully breached the organization's systems and acquired various documents belonging to the company.

The claimed attack and event details

The Qilin group announced the incident on April 23, 2025, the same day they claimed the attack took place. In their public announcement, the group asserts that they gained unauthorized access to the internal systems of United Caps. This access allegedly allowed the attackers to extract a variety of documents from the corporate environment.

To support their claims, the group has shared several file samples as part of their public announcement. These samples appear to be related to the internal operational processes of the organization. The presence of these samples on a leak site is a common tactic used by ransomware groups to pressure victims into meeting ransom demands.

Data involved in the breach

Based on the information provided by the threat actor, the following types of data are allegedly involved in the incident:

• Operational data
• Financial records

The samples provided by the group include various screenshots of tables and documents that appear to be linked to the organization's financial records and its day-to-day operational processes.

About United Caps

United Caps is an international packaging company that specializes in the production of plastic caps and closure solutions. Utilizing innovative designs and advanced technology, the company provides customized packaging solutions tailored for several key industries, including the food, beverage, and home care sectors. The organization is headquartered in Luxembourg.

Analysis and industry implications

The Qilin group is recognized as a threat actor that frequently employs double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information. They then threaten to leak this data on public platforms if the ransom is not paid, creating a dual pressure point for the victim.

This specific situation poses a significant risk of sensitive data being leaked or publicly exposed if the organization does not meet the group's demands. Because United Caps is based in Luxembourg, this breach may lead to legal implications under the EU General Data Protection Regulation (GDPR). Furthermore, the exposure of such data can create secondary risks, such as the potential for identity theft or the execution of targeted phishing attacks against the organization's employees and business partners.

The group's past activities suggest a pattern of targeting manufacturing companies of a similar scale. For organizations operating within the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing.

Summary of risks

The potential consequences of this breach include:

• Public exposure of sensitive operational and financial information.
• Legal and regulatory scrutiny under GDPR.
• Increased risk of secondary attacks like phishing or identity theft targeting stakeholders.