Root Security listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Singapore
• Sector: Technology
• Announcement date: March 10, 2026

The Qilin ransomware group has officially listed the Singapore-based technology firm Root Security on its dedicated leak site. This announcement, published on March 10, 2026, marks a significant development in the ongoing activity of the threat actor group, which is known for targeting organizations and employing aggressive extortion tactics.

The claimed attack and event details

According to the announcement published by the Qilin group, the threat actors claim to have successfully gained unauthorized access to the networks belonging to Root Security. Following this initial intrusion, the group alleges that they performed a data exfiltration operation, moving sensitive information from the organization's internal systems to external locations controlled by the attackers.

The timing of the claim coincides with the date the announcement appeared on the leak site. While the group has asserted that they have successfully compromised the target, they have not provided specific details regarding the methods used to penetrate the network or the exact nature of the breach. The listing serves as a public notification from the threat actors, signaling their intent to leverage the stolen information for their own purposes.

Information regarding the alleged leaked data

Despite the claim of a successful data exfiltration, the listing provided by the Qilin group remains remarkably vague regarding the specifics of the stolen information. At this stage, there is no information or screenshot available regarding the content of the data shared on the leak site. The threat actors have not disclosed the volume of the data or the specific categories of files that were allegedly taken during the intrusion.

The listing names no specific data types as being involved in the breach. Consequently, the exact scope of the information compromise remains unknown to the public and the organization at this time.

About Root Security

Root Security is a cybersecurity firm headquartered in Singapore. The company specializes in providing a wide range of professional services to various organizations, focusing on strengthening their defensive postures. Their service portfolio includes cybersecurity consulting, penetration testing, and vulnerability management, aimed at helping clients identify and mitigate potential security risks.

Analysis and potential implications

The Qilin group is recognized for its use of double extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information and threaten to publish it on public platforms if their demands are not met. This dual-layered approach significantly increases the pressure on the victim organization, as the threat of public exposure can lead to severe reputational damage and legal consequences.

The situation involving Root Security could lead to the exposure of internal data to third parties, which may result in significant disruptions to the organization's operational processes. Depending on the nature of the leaked data, secondary risks may arise, such as identity theft or targeted phishing attacks directed at the organization's employees or customers. Such attacks often leverage the stolen information to gain further access or to deceive individuals within the supply chain.

Furthermore, because the organization is based in Singapore, it may be subject to the Personal Data Protection Act (PDPA). Under this regulatory framework, the organization may be required to fulfill specific data breach notification obligations to the relevant authorities and affected individuals. Given the historical behavior of the Qilin group, it is assessed that the threat actors may be inclined to demand a ransom or proceed with sharing the data on public platforms.

In general, organizations facing such threats often prioritize incident response, forensic investigation, and enhanced monitoring of their networks. Strengthening defensive measures, such as implementing multi-factor authentication and rigorous patch management, remains a fundamental component of a robust cybersecurity strategy to mitigate the risk of similar future incidents.