Datanet Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that manages contracts for telecom and commercial real estate appears on a ransomware group's leak site, the people who may feel it first are not executives but lease administrators, tenants, vendors, and employees whose details sit inside those systems. On 23 May 2024, the ransomware group known as qilin listed Datanet, claiming it had exfiltrated internal files. Public detail on how many people are affected remains unknown, and the precise contents of the material have not been independently confirmed. For anyone whose organisation uses Datanet or whose personal or contractual data may have been stored there, the practical question is whether that information could now be misused for fraud, phishing, or competitive harm.

What is known so far is limited to the listing itself and the description of the product Datanet provides. That still leaves real stakes: contract portfolio systems routinely hold names, contact details, lease terms, financial schedules, and correspondence that can be weaponised if they leave the organisation's control.

What happened

According to public reporting dated 23 May 2024, Datanet was listed by the qilin ransomware group. The group claims that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown. No public confirmation has established the exact date of intrusion, the method of initial access, the volume of data taken, or whether systems were encrypted in addition to the alleged theft. The listing on a ransomware leak site is a claim by the threat actor; independent verification of the full scope has not been published in the available record. In short, the incident is reported as a ransomware-related data-exfiltration claim against Datanet, with the exposed material described only as internal files.

Inside qilin

Qilin is a well-documented ransomware operation that has operated as a ransomware-as-a-service model, sometimes also referred to in public reporting under the name Agenda. Groups of this type typically recruit affiliates who gain access to corporate networks, deploy encryption malware, and steal data before or during the attack so they can threaten publication if a ransom is not paid—a tactic known as double extortion. Qilin has been observed targeting organisations across multiple sectors and geographies, using leak sites to pressure victims by listing company names and, in some cases, sample files. Public analyses of the group describe common initial-access methods such as compromised credentials, phishing, or exploitation of exposed remote services, followed by lateral movement and data staging. None of that general pattern proves the precise technique used against Datanet; it only situates the claim within how qilin is known to operate. Claims made on the group's site about any particular victim should be treated as unverified until corroborated by the organisation or independent investigators.

Who is Datanet?

Datanet, also referred to as DataNet in product descriptions, provides contract portfolio management software aimed at mid-size organisations. Public descriptions characterise it as a tool used heavily by lease administrators, with specialisation in telecom and commercial real estate verticals, and an emphasis on an intuitive interface for managing contracts and related portfolios. Organisations of this kind sit at the centre of sensitive commercial relationships: they store and process lease agreements, counterparty details, renewal schedules, payment terms, and supporting correspondence. A breach involving such a platform is consequential because the data is not merely internal IT material; it often includes information belonging to customers, landlords, tenants, and suppliers who never chose to entrust their details directly to the software vendor. Disruption or exposure can therefore affect trust across an entire chain of commercial relationships, not only the vendor itself.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as specific fields, databases, or categories of personal information—has been disclosed in the public record. The number of people affected is unknown. Organisations that run contract portfolio management systems for telecom and commercial real estate typically hold lease documents, party names and contact information, financial schedules, property identifiers, and operational notes. Whether any of those categories were present in the material qilin claims to hold has not been confirmed. Until Datanet or a competent investigator publishes a verified inventory, the exact contents remain unconfirmed; readers should treat any specific list of exposed fields as speculative unless it comes from an official disclosure.

Why it matters

For individuals and businesses whose data may have been inside Datanet systems, the concrete risks are familiar but serious. Stolen contact details and contract terms can enable targeted phishing that appears legitimate because it references real leases or counterparties. Financial schedules and payment information can support invoice fraud or social-engineering attacks against accounts payable. Competitive or confidential commercial terms, if published or sold, can damage negotiating positions or reveal strategies to rivals. For Datanet itself, a ransomware listing raises operational, legal, and reputational pressure: customers may demand assurances, regulators may inquire depending on jurisdiction and data types, and the company must determine whether notification duties apply. Because the scale of the alleged exfiltration and the identities of affected parties remain unknown, the full extent of harm cannot yet be measured. That uncertainty itself is a cost—organisations and individuals must decide how much defensive effort to invest without a clear inventory of what left the network.

What to do if you're exposed

If you work with Datanet, manage leases through it, or believe your personal or company details may have been stored there, start with basic hygiene. Treat unexpected emails or calls that reference contracts, renewals, or payments with extra scepticism; verify through known channels before clicking links or transferring funds. Change passwords on related accounts, enable multi-factor authentication where available, and monitor financial and credit activity for unusual requests. If your organisation is a Datanet customer, ask the vendor for any official incident notice and guidance on what data categories are confirmed. Individuals can also run a free exposure scan of their email address against known breach datasets to see whether their information has already appeared in other incidents; that check does not prove involvement in this specific event, but it helps prioritise further monitoring. Stay alert for official updates from Datanet rather than relying solely on ransomware-site claims.

AICompiled with AI assistance from public sources and published under our editorial standards.