Zorlu Holding listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: September 20, 2026

The Qilin ransomware group has listed Zorlu Holding on its leak site, claiming a data breach against the organization. This announcement, which appeared on the group's portal, indicates a potential targeted cyberattack against the major industrial conglomerate.

The details of the claim

The threat actor known as Qilin has listed Zorlu Holding on its leak portal, claiming to have conducted a ransomware attack against the organization. The announcement was added to the system on September 20, 2026. The group alleges that it has obtained the organization's data, which indicates a potential use of double extortion tactics.

Double extortion is a common tactic employed by modern ransomware groups. In this scenario, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat actors then use the threat of leaking this stolen data on public forums or dedicated leak sites to pressure the organization into paying a ransom. This method increases the pressure on the victim, as the loss of data confidentiality poses a significant risk even if the organization can restore its systems from backups.

Data involved in the alleged breach

There is currently no information provided regarding the nature or content of the allegedly leaked data. The listing does not specify the types of files or the volume of information that has been targeted by the group.

About Zorlu Holding

Zorlu Holding is a major Turkey-based industrial and investment conglomerate operating in various sectors such as textiles, energy, home appliances, and electronics. Hosting major brands like Vestel, the company engages in production and trade on a global scale.

Risk assessment and implications

The Qilin (Agenda) group is known for employing double extortion tactics and typically encrypting data after infiltrating corporate networks. This situation may pose a risk of exposing employee information, trade secrets, or customer data within Zorlu Holding. A potential data breach could lead to legal obligations under KVKK and result in reputational damage for the organization. Furthermore, it is possible that the leaked data could be utilized for identity theft or targeted phishing attacks.

Given the group's past activities, it is assessed that the attack may also have indirect consequences on the supply chain. In a globalized manufacturing and trade environment, a breach at a major conglomerate can create ripple effects throughout its network of partners and suppliers. When a central node in a supply chain is compromised, the integrity of the entire network may be called into question, potentially leading to operational delays or secondary security risks for connected entities.

For organizations operating in large-scale manufacturing and diverse industrial sectors, maintaining robust cybersecurity posture is essential. This involves implementing multi-layered defense strategies, such as network segmentation, rigorous access controls, and continuous monitoring of network traffic to detect unauthorized exfiltration. Furthermore, regular security awareness training for employees can help mitigate the risk of initial access via phishing. As ransomware groups continue to evolve their tactics, organizations must prepare for the possibility of both operational disruption and data exposure, ensuring they have comprehensive incident response plans and legal compliance frameworks in place to address potential regulatory requirements.