Sakol Energy Public listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Thailand
• Sector: Energy & Utilities
• Announcement date: November 20, 2025

Qilin claims data exfiltration from Sakol Energy Public

The Qilin ransomware group has officially listed Sakol Energy Public on their leak site, claiming to have exfiltrated data from the organization. This announcement, made on November 20, 2025, marks a new development in the ongoing threat landscape facing the energy sector in Thailand.

The threat actor known as Qilin listed Sakol Energy Public on their leak platform on November 20, 2025. The group claims to have gained access to the organization's network and exfiltrated data. This listing indicates that the group is employing double extortion tactics to pressure the victim. Double extortion is a common strategy used by modern ransomware groups, where attackers not only encrypt a victim's systems but also steal sensitive information. The threat of leaking this stolen data on a public platform serves as additional leverage to coerce the organization into paying a ransom.

Details regarding the alleged data breach

While the listing confirms the group's intent to use stolen information as leverage, specific details regarding the breach remain limited. At this time, the nature of the allegedly exfiltrated data is not specified in the provided screenshot or registration details. Furthermore, the listing does not provide information regarding the total size of the data stolen or the specific number of files involved. There is also no information available concerning a specific ransom demand.

About Sakol Energy Public

Sakol Energy Public Company Limited is a Thailand-based energy company. The company primarily operates in the production of biomass energy and renewable energy projects.

Analysis and potential impact

Qilin is a ransomware-as-a-service (RaaS) group active since 2022, known for utilizing double extortion tactics. This incident may lead to the exposure of sensitive operational data or customer information. Given that the energy sector is considered critical infrastructure, such a breach could potentially impact the organization's operational continuity and reputation. Furthermore, the organization may face legal consequences under relevant data protection regulations in Thailand.

Beyond the immediate impact on the organization, secondary risks should also be considered. These include the potential use of leaked data for identity theft or targeted phishing campaigns. When sensitive information is leaked, attackers often use it to craft more convincing social engineering attacks against employees or customers, increasing the risk of subsequent breaches.

For organizations operating within critical infrastructure sectors, such as energy and utilities, maintaining robust cybersecurity posture is essential. Defensive strategies typically involve implementing multi-factor authentication, maintaining rigorous patch management protocols, and conducting regular network monitoring to detect unauthorized access. Additionally, organizations often rely on comprehensive data backup strategies and incident response plans to mitigate the impact of such attacks and ensure operational continuity.