Tohlen Building Technology Group listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Germany
• Sector: Professional Services
• Announcement date: May 3, 2024

Qilin ransomware group claims attack on Tohlen Building Technology Group

The Qilin ransomware group has listed the German organization Tohlen Building Technology Group on its dedicated leak site. According to the announcement made on May 3, 2024, the threat actor group claims to have acquired data belonging to the company. This development follows a pattern of activity observed from the group, which has been known to be active since 2022.

The group is recognized for employing double-extortion tactics. In such a scenario, attackers do not merely encrypt an organization's internal systems to disrupt operations; they also exfiltrate sensitive information prior to the encryption phase. This allows the threat actors to threaten the victim with the public release of their data on a leak site if a ransom is not paid, thereby increasing the pressure on the target organization.

Details of the claimed breach

The Qilin group published the listing on May 3, 2024, claiming the attack took place on the same day. While the group has officially claimed responsibility for the incident, the specific details regarding the stolen information remain limited. At this stage, no screenshots or detailed information regarding the content of the leaked data have been provided by the attackers.

The listing does not specify the volume of data involved or the specific types of files that were allegedly compromised. Consequently, the listing names no specific data types.

About Tohlen Building Technology Group

Tohlen Building Technology Group is a building technology company based in the North Rhine-Westphalia region of Germany. The organization employs approximately 140 people and maintains a significant regional presence. The company's operations are primarily centered in several key German cities, including Aachen, Cologne, Bonn, Düsseldorf, Duisburg, and Essen.

Risk assessment and implications

The leakage of an organization's data can lead to various secondary risks. For the employees and customers of the affected company, such a breach may create risks such as identity theft or the possibility of targeted phishing attacks. Furthermore, because the organization operates within Germany, a potential data breach could lead to legal processes and administrative sanctions under the General Data Protection Regulation (GDPR).

The past activities of the Qilin group increase the possibility that the data may be shared or sold to third parties. This adds a layer of risk beyond the initial extortion attempt. Additionally, the organization's supply chain partners may also be indirectly affected by this situation, as breaches in one company can often serve as a stepping stone or a point of impact for connected business partners.

The use of the double-extortion method by the group is likely intended to pressure the organization into paying a ransom by leveraging the threat of public exposure. To mitigate such risks, organizations in the professional services sector often implement defensive measures such as robust data encryption, strict access controls, and comprehensive employee training to recognize phishing attempts. Maintaining regular, offline backups and monitoring for unauthorized data exfiltration are also standard practices to defend against these types of sophisticated ransomware threats.