BRIEFRansomwarehighP52
Qilin ransomware lists Heartland Construction Group
Heartland Construction Group
Detected15 November 2026 · 21:13 UTC
The Qilin ransomware group added Heartland Construction Group, a US manufacturing-sector company, to its public leak site. Publication means stolen corporate data may be released if no negotiation succeeds, exposing internal documents and customer information. Construction and industrial firms should treat this as a supply-chain breach indicator.
CategoryRansomware
Severityhigh
Priority score52
Detected15 November 2026 · 21:13 UTC
RansomwarePriority 40
Qilin publica a la empresa estadounidense Apex en su sitio de extorsiónQilin added a US victim named Apex to its leak site, but the sector and full legal entity are not identified in the listing. Without a confirmed industry or domain, attribution to a specific organization remains ambiguous. It is worth tracking only in case further data or a clearer identity is released.RansomwarePriority 50
Qilin publica a la firma Atlas Evaluation & Inspection ServicesQilin ransomware listed Atlas Evaluation & Inspection Services, a US professional-services and inspection firm, on its extortion site. Such firms hold client project data and audit records, so a leak can cascade to the clients they serve. Organizations that contracted Atlas for inspections or certifications should assess what data was shared.RansomwarePriority 44
Ransomware Incransom publica a la indonesia Sarimelati KencanaThe Incransom group listed PT Sarimelati Kencana Tbk, the Indonesian Pizza Hut franchisee, as a new victim on its ransomware leak site. The victim is a food and beverage manufacturer with nationwide restaurant operations, so disruption can affect supply and POS systems, but it is outside Argentina and Latin America. It is reported as context for the group's activity rather than an immediate regional alert.RansomwarePriority 42
Ransomware Qilin publica a la ingeniería estadounidense Kessler SoilsThe Qilin group listed Kessler Soils Engineering Products, a US manufacturing and geotechnical engineering supplier, on its leak site. Details of the intrusion and data volume are not public, but Qilin typically publishes stolen project and client data if no payment occurs. It matters for construction and engineering supply chains that may share technical documentation with this vendor.RansomwarePriority 42
Ransomware Qilin publica a la manufacturera estadounidense Cole ManufacturingQilin added Cole Manufacturing, a US manufacturing firm, to its extortion leak site. The listing provides no scope or data details yet, but such entries typically accompany stolen internal documents and operational data. It is relevant for tracking Qilin's continued targeting of US manufacturing and for partners assessing supply-chain risk.RansomwarePriority 45
Ransomware Qilin publica a la textil estadounidense Oregon LinenThe Qilin extortion group listed Oregon Linen, a US manufacturing/textile company, on its leak site. No data volume or access details are disclosed, but a fresh Qilin listing usually precedes publication of stolen corporate files and customer data. It matters mainly as an indicator of Qilin's active US manufacturing campaign and for suppliers monitoring downstream exposure.