HOST Software Entwicklung und Consulting GmbH Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

HOST Software Entwicklung und Consulting GmbH, a German software firm known for its Ulysses ERP and MES systems aimed at manufacturing small and medium-sized enterprises, was listed by the qilin ransomware group on or around February 24, 2025. Public reporting indicates that internal files were exfiltrated as part of a ransomware attack, though the number of people affected remains unknown and further operational details have not been disclosed.

The listing itself constitutes a claim by the group rather than independently verified confirmation of the full scope. For an organisation whose products handle core business processes in manufacturing, any such incident raises questions about the security of operational data and the potential exposure of information belonging to the company and its clients.

What happened

According to available public information, HOST Software Entwicklung und Consulting GmbH appeared on a qilin-associated leak site, with the report dated February 24, 2025. The facts state that internal files were exfiltrated in a ransomware attack. No further specifics have been released regarding the precise timing of the intrusion, the initial access method, the volume of data taken, or whether systems were encrypted in addition to the exfiltration. The number of individuals potentially affected is listed as unknown. Public detail on the incident remains limited to the group’s claim of having obtained internal files and the organisation’s identification as a victim listing.

The group behind it: qilin

qilin is a ransomware operation that has been active in the threat landscape for several years, typically functioning as a ransomware-as-a-service model. Groups of this type commonly gain initial access through phishing, exploited vulnerabilities, or compromised credentials, then move laterally, exfiltrate data, and deploy encryption tools while threatening to publish stolen material if a ransom is not paid. qilin has been associated with attacks on a range of organisations across multiple sectors, often publicising victim names on dedicated leak sites to increase pressure. In this case the group claims to have listed HOST Software Entwicklung und Consulting GmbH and to have exfiltrated internal files; those assertions have not been independently confirmed in the available facts, and no additional statements attributed specifically to this victim beyond the listing itself have been provided.

Who is HOST Software Entwicklung und Consulting GmbH?

HOST Software Entwicklung und Consulting GmbH develops and supports Ulysses, described as a comprehensive ERP and MES software suite tailored for manufacturing SMEs. The product line includes modules and add-ons designed for industries such as plant and steel construction and sheet-metal work, covering production planning, shop-floor control, inventory, and related business processes. Organisations of this type typically maintain source code, customer configuration data, support records, and internal operational documents. Because the software sits at the centre of manufacturing workflows for its users, a compromise at the vendor level can have downstream implications for the confidentiality of client-related information and for confidence in the integrity of the systems those clients rely on.

What data was at risk

The facts identify the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of specific file types, databases, or personal data categories has been disclosed. Companies that develop and maintain ERP and MES platforms commonly hold source code, technical documentation, customer contracts, support tickets, employee records, and configuration data that may include production schedules or supplier details belonging to clients. Whether any of those categories were present among the files claimed by qilin remains unconfirmed. Exact contents and the number of records involved are therefore unknown.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, credentials, or other personal data if such material was present. For manufacturing clients of the Ulysses platform, exposure of configuration or operational data could reveal business processes or commercial relationships. The organisation itself faces the usual consequences of a claimed ransomware incident: operational disruption, the cost of investigation and remediation, possible regulatory notification obligations under European data-protection rules, and reputational effects among customers who depend on the software for daily production. Because the scale and precise contents remain undisclosed, the concrete impact on any given person or client cannot yet be quantified.

Were you affected?

If you are an employee, customer, or partner of HOST Software Entwicklung und Consulting GmbH, monitor official communications from the company for any notification regarding the incident. Change passwords associated with accounts that interact with the firm’s systems, enable multi-factor authentication where available, and remain alert for phishing attempts that might reference the breach. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Until more detailed confirmation is released, treat any claim of compromise as provisional and act on the precautionary steps above.

AICompiled with AI assistance from public sources and published under our editorial standards.