ZEF listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Finland
• Sector: Government & Defense
• Announcement date: September 21, 2025

Qilin ransomware group claims attack on ZEF

The Qilin ransomware group has published a leak announcement on its dedicated leak site, claiming to have successfully targeted ZEF (Center for Development Research). According to the announcement posted on September 21, 2025, the threat actor group alleges that they have obtained sensitive information belonging to the institution. This development highlights the ongoing threat posed by sophisticated ransomware groups that target academic and research-oriented organizations.

The group is currently employing a double-extortion tactic in this incident. Double extortion is a common ransomware strategy where attackers do not merely encrypt an organization's systems to disrupt operations, but also exfiltrate sensitive data before the encryption occurs. The attackers then threaten to publish the stolen information on public leak sites if their demands are not met. This method increases the pressure on the victim, as the threat of a public data leak can cause significant reputational and legal damage, even if the organization has robust backups to restore its systems.

Details of the claimed breach

The announcement made by the Qilin group alleges that the compromised information pertains to the institution's research activities and its various operational processes. While the group claims to have gained access to these internal functions, the exact scope and volume of the leaked data have not been specified. No information was provided regarding the total size of the data or the specific number of files involved.

Although the group has not provided a detailed list of data types, a screenshot associated with the announcement shows documents that appear to be related to the institution's academic and administrative processes. The presence of such documents suggests that the breach may impact the internal management and scholarly functions of the organization.

About ZEF

ZEF, known as the Center for Development Research, is an interdisciplinary research institute located at the University of Bonn. The organization is dedicated to conducting scientific research across several critical fields, including political, economic, and general development. Beyond its primary research mission, ZEF provides specialized advisory services to various national and international organizations, making it a key player in the global development sector.

Potential impacts and security considerations

This incident may result in the exposure of the institution's academic and administrative data, which could potentially lead to negative impacts on its institutional reputation. Furthermore, because ZEF operates as an institution in Germany, the breach could lead to data protection violations under the General Data Protection Regulation (GDPR), which could potentially trigger legal sanctions.

The use of the double-extortion tactic by the Qilin group suggests that the leaked data could be utilized for secondary risks. These risks include identity theft or the execution of targeted phishing attacks against the institution or its partners. Additionally, given that the institution maintains various international partnerships, there are potential risks regarding supply chain security that may be observed as a result of this breach.

For organizations operating in similar sectors, maintaining robust security postures is essential. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Furthermore, organizations with international dependencies must monitor their supply chain security to mitigate risks that could propagate through their network of partners.