Testima Engineering targeted by killsec in alleged data breach

• Ransomware group: killsec
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: April 1, 2025

Testima Engineering has been listed on a leak site by the threat actor known as killsec, who is alleging a significant data breach against the Turkish firm. The announcement, which appeared on April 1, 2025, indicates that the group claims to have successfully exfiltrated sensitive information belonging to the organization.

The details of the claim

According to the announcement posted on the killsec leak portal, the group claims to possess data belonging to Testima Engineering. The threat actor has initiated a countdown process, a common tactic used in ransomware extortion, which suggests that the stolen data may be published on the site if specific demands are not met. While the announcement includes a reference to a ransom demand, the specific details regarding the amount or the nature of the demands were not provided in the source.

In many modern cyberattacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak confidential information publicly, the attackers increase the pressure on the victim to pay the ransom, as the loss of reputation and intellectual property often outweighs the cost of system restoration.

Data allegedly involved in the breach

The information provided by the threat actor includes screenshots of file lists. These lists contain various folder names that suggest the presence of highly sensitive documentation. Based on the available information, the data allegedly compromised includes:

• Technical drawings
• Engineering projects
• Customer data

The presence of such files suggests that the breach may have targeted the core operational and intellectual assets of the company. When attackers target specific file types like technical drawings or project files, they are often looking for high-value information that can be used for further exploitation or extortion.

About Testima Engineering

Testima Engineering is a Turkish company that provides engineering, procurement, and construction (EPC) services. The organization operates within the industrial sector, specifically supporting industrial plants, power plants, and various infrastructure projects. Their technical expertise is focused on mechanical installation, piping, and steel construction.

Implications and industry risks

This incident may pose a significant risk to the company's intellectual property and trade secrets. The technical data allegedly leaked could be exploited by competitors or serve as a basis for supply chain attacks. In the manufacturing and engineering sectors, technical drawings and project specifics are vital assets; if these are leaked, they can compromise the integrity of future projects or allow competitors to gain an unfair advantage.

Furthermore, the motivation behind this attack may not be limited to financial gain. It has been reported that killsec has hacktivist origins, which adds a layer of complexity to the incident. Hacktivist-driven attacks often focus on ideological or political messaging rather than purely monetary outcomes, making negotiations and threat mitigation more unpredictable.

Depending on the region of operation, the company may face data breach notification requirements and potential legal sanctions. Beyond the corporate impact, if the data is published, it is likely that employees and customers could be exposed to secondary risks such as identity theft. Organizations in this sector can mitigate such risks by implementing robust data loss prevention (DLP) strategies, maintaining strict access controls for technical documentation, and ensuring comprehensive encryption for all sensitive project files both at rest and in transit.