Rihatec.de listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Germany
• Sector: Technology
• Announcement date: October 4, 2025

Qilin group claims data breach at Rihatec.de

The Qilin ransomware group has officially listed the German technology firm Rihatec.de on its dedicated leak site. This announcement, posted on October 4, 2025, follows a claimed attack date of October 3, 2025. Through this listing, the threat actor group alleges that they have successfully breached the organization's systems and exfiltrated various types of data from the company's infrastructure.

Ransomware leak sites serve as a platform for cybercriminals to pressure victims by threatening to release sensitive information if demands are not met. In this instance, the group has provided certain details to support their claims, including information regarding the company's operations and various screenshots intended to demonstrate the successful theft of files.

Details of the alleged exfiltration

While the Qilin group has published evidence of the breach, the exact scope and volume of the allegedly exfiltrated data have not been specified. No information was provided regarding the total size of the data stolen or the specific count of files involved in the incident. Furthermore, no ransom demand has been publicly disclosed in the current announcement.

The group's announcement includes screenshots that appear to contain samples of the stolen information. Based on these visual samples, the data is believed to consist of the following:

• Corporate documents
• Technical files

The presence of these files in the group's possession suggests a targeted effort to acquire sensitive internal documentation. It is important to note that the group is employing double extortion tactics. In a double extortion scheme, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage, threatening to publish or sell the information on public forums or dark web marketplaces to increase the pressure on the victim to pay the ransom.

About Rihatec.de

Rihatec Systemlösungen GmbH is a German-based company that specializes in the automation of control systems and industrial technology solutions. Since its founding in 1995, the firm has established itself as a provider of engineering and system integration services, specifically designed for large-scale corporate projects.

Potential risks and industry implications

This incident, as claimed by the Qilin group, introduces significant risks to the organization. The unauthorized access to systems could lead to the disclosure of the company's trade secrets and critical operational data. Because Rihatec.de is based in Germany, any confirmed breach of personal or sensitive data could potentially trigger legal proceedings and administrative sanctions under the General Data Protection Regulation (GDPR).

Beyond the immediate impact on the organization itself, this breach carries broader implications for the security landscape. Because Rihatec.de provides specialized engineering and system integration services for large-scale corporate projects, their security posture is linked to the security of their clients. The organization's cooperation with large corporations creates a potential risk factor that could affect third parties in terms of supply chain security. When a specialized technology provider is compromised, the interconnected nature of modern industrial and corporate networks means that the breach could potentially impact the integrity of the entire supply chain.

For organizations operating in the technology and industrial automation sectors, such incidents highlight the necessity of robust defensive measures. Common defensive strategies include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized exfiltration, and ensuring regular, offline backups of critical technical and corporate data. Furthermore, managing third-party risks through rigorous vendor security assessments is essential to mitigate the potential for supply chain contagion.