Questica listed on Qilin ransomware leak site following alleged data breach

• Ransomware group: Qilin
• Country: Canada
• Sector: Technology
• Announcement date: December 28, 2025

Qilin ransomware group targets Questica

The Qilin ransomware group has listed the technology company Questica on their leak site, alleging a data breach. This announcement, made on December 28, 2025, marks a new development in the group's ongoing activities targeting various sectors.

Details of the alleged attack

According to the announcement posted on the group's leak portal, the threat actor claims to have successfully gained access to the organization's network. The group alleges that they have exfiltrated data from the target's systems. While the specific nature of the breach has been announced, the group may be attempting to extort the organization using a double-extortion model.

Double extortion is a common tactic used by modern ransomware groups. In this model, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid. This approach increases the pressure on the victim, as the threat of a public data exposure can cause significant reputational and legal damage, even if the organization has robust backups to restore its systems.

Information regarding the leaked data

Regarding the specific content of the breach, there is no specific information regarding the nature of the alleged leaked data in the provided records or the screenshots provided by the group.

About Questica

Questica is a technology company that provides budgeting and performance management software solutions for the public sector, educational institutions, and non-profit organizations. Their cloud-based platforms help organizations optimize their budget planning, monitoring, and reporting processes.

Impact and industry implications

The Qilin group, also known as Agenda, is a ransomware-as-a-service actor that has been active since 2022. They frequently employ double-extortion tactics in their operations. This specific incident may impact the organization's operational continuity and poses a risk of exposing sensitive customer information. Given that the organization is based in Canada, the incident could trigger legal obligations under PIPEDA regulations.

Furthermore, the leaked data may potentially be utilized for identity theft or targeted phishing campaigns. The group's history suggests they may target various sectors, including healthcare and technology. For organizations operating in the technology and software-as-a-service sectors, such incidents highlight the importance of maintaining high security standards to protect client data and ensure service availability.

To defend against such threats, organizations typically focus on several defensive layers. This includes implementing multi-factor authentication across all remote access points, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular offline backups to ensure data can be recovered without paying a ransom. Additionally, monitoring network traffic for unusual data exfiltration patterns can help detect an intrusion before data is successfully moved out of the environment. Continuous security awareness training for employees also remains a critical component in preventing initial access through phishing or social engineering.