melilla.es Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 21 June 2025 the official domain of Spain’s autonomous city of Melilla, melilla.es, appeared on the leak site operated by the ransomware group known as qilin. Public reporting states that internal files were exfiltrated during a ransomware attack; the number of people affected remains unknown and further technical detail has not been released by the city or by independent investigators.

Because the listing comes from the threat actors themselves and has not been independently confirmed in full, the precise scope of the incident is still limited. What is clear is that a government entity responsible for local public services has been claimed as a victim, raising immediate questions about the security of administrative data and the potential impact on residents and staff.

Breaking down the breach

According to the available record, qilin listed melilla.es after what the group described as a serious hacker attack on the autonomous city of Melilla. The only data category named is “internal files exfiltrated in ransomware attack.” No exact date of intrusion, no volume of data, and no confirmation of encryption or operational disruption have been published by the city authorities. The group’s own statement notes that officials did not contact them, after which the listing was posted. Beyond that claim, public detail on method, dwell time or containment remains undisclosed.

The group behind it: qilin

Qilin is a well-documented ransomware-as-a-service operation that has been active for several years. Like many contemporary groups it typically employs double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Affiliates of the group have previously targeted organisations across Europe and other regions, often focusing on entities that hold sensitive administrative or commercial records. In this case the only specific assertion about Melilla is the leak-site listing itself; any further claims of pressure or negotiation remain unverified outside the group’s own statements.

melilla.es and its sector

melilla.es is the principal online presence of the Autonomous City of Melilla, a Spanish exclave on the North African coast that functions as a self-governing municipality with its own local government, public services and administrative records. City portals of this type routinely manage citizen registries, municipal tax data, social-service files, employment records and internal correspondence. A breach affecting such an organisation therefore carries consequences that extend beyond ordinary commercial data loss, because the information often includes identifiers and service histories of residents who have little choice but to interact with the local administration.

What data was at risk

The sole category publicly named is internal files obtained through the ransomware attack. No inventory of those files has been released, so it is not possible to state with certainty whether they contain personal identifiers, financial records, health-related notes or purely operational documents. Organisations of this kind typically hold a mixture of the above; until official confirmation or a fuller leak appears, the exact contents remain unconfirmed. The number of individuals potentially exposed is likewise listed as unknown.

Why it matters

For residents and staff, the practical risk is that personal or administrative data could be misused for identity fraud, targeted phishing or unsolicited contact. Even if the files prove less sensitive than feared, the mere fact of unauthorised access can erode trust in local institutions and force the city to divert resources to forensic work, system hardening and possible notification duties. For the organisation itself, the incident underscores the continuing exposure of public-sector networks to ransomware groups that treat government entities as viable targets. Recovery costs, reputational damage and any subsequent regulatory scrutiny are real, even when the full scale of data loss is still unclear.

Were you affected?

If you have had dealings with Melilla’s municipal services—tax payments, social benefits, employment or residency matters—monitor bank statements and official correspondence for unusual activity. Change passwords on any accounts that reuse credentials linked to city portals, and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has already appeared in public dumps. Official updates, if any, will come from the city administration or Spanish data-protection authorities; until then, treat the qilin listing as an unverified claim and remain cautious with unsolicited messages that reference Melilla or municipal records.

AICompiled with AI assistance from public sources and published under our editorial standards.