Waxhaw.com targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: United States
• Sector: Government & Defense
• Announcement date: September 25, 2025

Qilin ransomware group claims data breach at Waxhaw.com

The Qilin ransomware group has published a listing on its leak site claiming to have stolen data belonging to Waxhaw.com. According to the announcement, the breach was identified on September 25, 2025. The group's post alleges that they have successfully compromised the systems of the municipal government entity, potentially exposing a wide array of administrative and sensitive documents.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. This allows the attackers to threaten the public release of the stolen data on their leak sites if the ransom demand is not met, significantly increasing the pressure on the victim organization.

Details of the alleged data theft

The Qilin group claims to have obtained various municipal administrative and contractual documents through this attack. The announcement alleges that the leaked data includes documents related to municipal projects as well as potentially sensitive personal information. The scope of the alleged theft is broad, covering various aspects of municipal operations and sensitive individual records.

The specific types of data claimed to be involved in the breach include:

• Municipal contracts
• Audit reports
• Medical records
• Credit card information
• Employee payment records
• Identity documents

The group's claims suggest that the breach encompasses everything from high-level procurement and contract files to highly sensitive individual information such as medical records and financial data. This combination of administrative and personal data can create significant challenges for the affected institution.

About the organization

Waxhaw is a town located in the state of North Carolina, United States. It serves as a municipal government entity that provides local administrative services to its residents.

Impact and implications of the incident

This incident suggests that sensitive data belonging to a local government entity may have been compromised. The alleged presence of medical records and financial information indicates that affected individuals may be at risk of identity theft and fraud. Such attacks against public institutions may lead to the disruption of municipal services and the erosion of public trust.

Under US state laws and federal regulations, the institution may be required to fulfill data breach notification obligations. When public entities are targeted, the fallout often extends beyond immediate technical remediation to include legal and regulatory compliance issues. The Qilin group, which has been an active Ransomware-as-a-Service (RaaS) operator since 2022, is known for these types of high-pressure extortion tactics.

For organizations in the government and defense sector, protecting against such threats involves several defensive steps. Implementing robust multi-factor authentication (MFA) across all administrative access points is a fundamental step in preventing unauthorized entry. Additionally, maintaining rigorous network segmentation can help prevent attackers from moving laterally from less secure parts of the network to sensitive databases containing medical or financial records. Regular, offline backups are also critical to ensure that services can be restored in the event of a ransomware encryption event, although they do not prevent the data exfiltration used in double extortion.