SAAM Towage listed on qilin ransomware leak site

• Ransomware group: qilin
• Country: Chile
• Sector: Transportation
• Announcement date: April 10, 2026

The maritime services provider SAAM Towage has been listed on the leak site of the qilin ransomware group. On April 10, 2026, the threat actors behind the qilin group announced that data belonging to the organization has been compromised. This announcement marks a recent development in the ongoing activities of the group, which continues to target various sectors through its online platform.

The claim by qilin

The qilin group officially listed SAAM Towage on its dedicated leak platform on April 10, 2026. According to the claims made by the threat actors, the organization's data has been successfully compromised during the attack. While the group has made this public announcement, it is important to note that the listing serves as a claim by the attackers. At this stage, no screenshots or specific evidence regarding the content of the alleged leak have been provided by the group to substantiate their claims.

Data involved in the incident

Regarding the specifics of the alleged breach, there is currently no information available concerning the type or the content of the data that has supposedly been leaked. The listing does not provide any details regarding the volume or the specific file types involved in the incident. Furthermore, no screenshots have been provided to illustrate the nature of the compromised information.

About SAAM Towage

SAAM Towage is an international maritime company that provides a variety of essential services, including towage, salvage, and maritime support services within various ports. Based in Chile, the company maintains an extensive operational network that spans across the Americas, providing critical support to the maritime and transportation sectors.

Analysis and implications

This incident indicates that the qilin group is employing a double-extortion tactic to threaten the disclosure of corporate data. In a double-extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to leak this information publicly, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of sensitive corporate or personal information.

If the data is indeed leaked, it may lead to significant disruptions in the organization's operational processes. Furthermore, such a leak poses a serious risk of exposing the personal information of employees. Because SAAM Towage is based in Chile, the organization may face specific challenges regarding compliance with local data protection regulations following a potential breach.

There is also the risk that the leaked data could potentially be used in secondary attacks or targeted phishing campaigns against the organization or its partners. Such campaigns often use stolen information to craft highly convincing messages to deceive employees or clients. Publicly available information regarding the qilin group remains limited, making it difficult to ascertain their full scope of operations or specific long-term objectives.

For organizations operating in the transportation and maritime sectors, maintaining robust cybersecurity posture is essential. General defensive measures often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against phishing attempts. As ransomware groups continue to use extortion tactics, the importance of monitoring for data exfiltration and ensuring compliance with regional data protection laws remains a critical component of organizational resilience.