Salag listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Poland
• Announcement date: March 15, 2026

Qilin ransomware group claims attack on Salag

The Qilin ransomware group has officially listed the Polish company Salag on its dedicated leak site. This announcement, made on March 15, 2026, indicates that the threat actor group claims to have successfully compromised the organization's digital assets. By appearing on the group's leak site, the incident highlights a potential intervention against the company's digital infrastructure, as the group has threatened to release the allegedly stolen information to the public.

Ransomware leak sites serve as a primary tool for extortion-based cybercrime. In these scenarios, threat actors use the threat of public exposure to pressure organizations into paying a ransom. The presence of a victim on such a site is a significant indicator of a targeted cyberattack aimed at disrupting operations or exfiltrating sensitive information for secondary leverage.

Details of the claimed breach

According to the announcement, the Qilin group claims to have gained unauthorized access to the organization's data. The group's listing serves as a public threat, asserting that the information will be released if their demands are not met. However, specific details regarding the scale of the breach remain unavailable. There is no information provided regarding the total size of the data stolen or the specific count of files involved in the incident. Furthermore, the group has not disclosed a specific ransom demand in their public announcement.

Regarding the nature of the stolen information, the listing does not name any specific data types. While screenshots may be provided by the threat actors to prove the breach, the content within these images is blurred, making it impossible to identify the exact types of data that have been compromised.

About Salag

Salag is a logistics and transport company based in Poland. The organization specializes in providing international road transport and logistics solutions, serving as a key player in the regional supply chain infrastructure.

Potential impact and risks

This incident carries several significant risks for the organization. One primary concern is the potential disruption to the organization's operational continuity. When digital assets are compromised, the ability to manage logistics and transport services can be severely hindered. Additionally, depending on the nature of the data claimed to be leaked, the organization may face legal processes regarding data protection obligations under the General Data Protection Regulation (GDPR) in the European Union.

The Qilin group is known to employ the double-extortion method. This tactic involves both encrypting a victim's systems and stealing sensitive data to use as leverage. This approach exposes the organization to secondary risks, such as identity theft or targeted phishing attacks against the company or its clients. Furthermore, there is a risk that the organization's supply chain partners could also be negatively affected by this situation, potentially leading to cascading disruptions across the logistics network.

The Qilin group is a known entity in the cyber threat landscape, having been active since 2022. The group operates using the Ransomware-as-a-Service (RaaS) model, which allows different affiliates to use their malware infrastructure to conduct attacks, increasing the frequency and reach of their operations. Organizations facing such threats typically focus on strengthening their defensive posture through robust backup strategies, network segmentation, and continuous monitoring of their digital environment to mitigate the impact of such intrusions.