Merko Ehitus Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Merko Ehitus was listed by the qilin ransomware group on 15 December 2025, with internal files reported as exfiltrated in the incident. The number of individuals affected is undisclosed; anyone connected to the company should check for any follow-up notifications and review their own security measures.
What happened
Merko Ehitus appeared on the qilin ransomware group’s leak site on December 15, 2025. The listing states that internal files were exfiltrated. No further details on the timing of the intrusion, the volume of data, or the method of access have been disclosed.
Who is qilin?
Qilin is a ransomware-as-a-service operation that has been publicly active since at least 2022. The group typically works with affiliates who deploy encryption tools on targeted networks and exfiltrate data before demanding payment. When victims do not pay, the group posts samples or links to stolen material on its leak site. This double-extortion approach has been documented across multiple incidents involving organisations in various sectors.
About Merko Ehitus
Merko Ehitus operates as a construction and engineering company, primarily active in the Baltic region and Nordic markets. Firms of this type routinely maintain records on employees, subcontractors, project timelines, financial transactions, and client specifications. A breach at such an organisation can therefore touch both corporate operations and the personal information of individuals connected to its projects.
What was likely exposed
The qilin listing claims that internal files were taken. The exact categories of data have not been confirmed or published. Organisations in the construction sector commonly store employee contact details, payroll information, supplier contracts, and technical project documents, but whether any of these specific types are present in the claimed exfiltration remains unverified.
Why it matters
Exposure of internal files can lead to follow-on misuse of personal identifiers or business relationships. Individuals may encounter increased attempts at phishing or identity-related fraud if their details appear in the material. For the organisation, the incident adds operational disruption and potential regulatory scrutiny under data-protection rules that apply to companies handling personal information in the European Economic Area.
Were you affected?
Check any recent communications from Merko Ehitus or its partners for official notices. Monitor accounts linked to the company for unusual activity. Individuals can also run a free exposure scan of their email address against known breach datasets to see whether their information has appeared in previously published leaks.
- Review bank and credit statements for unexpected entries.
- Enable multi-factor authentication on any accounts that may share details with the company.
- Consider placing a fraud alert with credit agencies if personal identifiers were likely stored.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Dom Development Listed by qilin Ransomware GroupDolan Construction Listed by qilin Ransomware GroupKier & Wright Listed by qilin Ransomware GroupThe Parkes Companies Listed by qilin Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Merko Ehitus Listed by qilin Ransomware Group →
Publicly posted by qilin — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.