Sky-mac listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Singapore
• Sector: Manufacturing
• Announcement date: June 3, 2025

The Qilin ransomware group has listed the Singapore-based manufacturing company Sky-mac on its dedicated leak site. The announcement, which surfaced on June 3, 2025, indicates that the threat actor group claims to have successfully carried out a cyberattack against the organization.

The details of the claimed attack

According to the announcement posted by the Qilin ransomware group, the attack is claimed to have occurred on June 2, 2025. The group has categorized this incident as a data breach. By listing the company on their leak site, the threat actors are employing a double-extortion strategy. This tactic involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to threaten its public release, thereby increasing the pressure on the victim to pay the ransom.

Ransomware leak sites serve as a platform for cybercriminals to shame their victims and demonstrate their capabilities. When a group utilizes double extortion, they aim to maximize leverage by threatening to leak proprietary or sensitive information if their demands are not met. This approach targets the victim's reputation and regulatory standing in addition to their immediate operational capabilities.

Information regarding the leaked data

At this stage, the specific details regarding the content of the leaked data have not been shared by the attackers. The information provided in the leak site announcement consists of a screenshot that summarizes the company's areas of operation rather than providing a catalog of stolen files. No specific information was provided regarding the total size of the data or the exact number of files involved in the breach.

Because the listing does not specify the types of data stolen, the exact scope of the information compromise remains unknown. In many such incidents, the lack of immediate detail is common during the initial stages of a leak site announcement.

About Sky-mac

Sky-mac is an established company based in Singapore. Since its inception in 1987, the organization has specialized in the design, installation, service, maintenance, and repair of Air-Conditioning and Mechanical Ventilation (ACMV) and HVAC systems. As a player in the manufacturing and technical services sector, the company provides essential infrastructure support through its specialized mechanical and ventilation solutions.

Analysis and potential implications

The use of double-extortion tactics by the Qilin group can lead to significant consequences for an organization. Such attacks may negatively impact a company's operational continuity and its commercial reputation. For a Singapore-based entity like Sky-mac, a data breach may also lead to legal consequences under the Personal Data Protection Act (PDPA).

The exposure of sensitive information, such as employee or customer data, can create secondary risks. These include the potential for identity theft and the execution of targeted phishing attacks against the affected individuals. Given the historical activities of the Qilin group, there is a possibility that the data claimed to be stolen may be made public in subsequent stages of the extortion process.

To defend against such threats, organizations in the manufacturing and technical services sectors often implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication across all systems, and conducting regular security awareness training for employees. Furthermore, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations are critical components of a modern cybersecurity posture.