NovAtel (belongs to Hexagon) Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

NovAtel, a positioning and navigation technology company owned by Hexagon, appeared on the leak site operated by the qilin ransomware group on November 24, 2025. The listing states that internal files were taken during a ransomware incident. No confirmation of the volume of data, the method of access, or the number of individuals affected has been made public, leaving the precise scope of the event unknown at this time. Such listings have become a recurring feature of ransomware operations that combine encryption with the threat of data publication.

Breaking down the breach

The only confirmed public detail is the appearance of NovAtel on the qilin leak site. The group asserts that internal files were exfiltrated. No information has been released about the date of the intrusion, the encryption of systems, ransom demands, or any payment. The number of people whose information may be involved remains undisclosed.

The group behind it: qilin

Qilin is a ransomware operation that maintains a leak site to publish data from victims that do not meet its demands. The group follows the double-extortion model common among current ransomware actors: data is copied before encryption, and the threat of publication is used to increase pressure. Public reporting has linked qilin to intrusions across multiple industries, with listings appearing on its site when negotiations fail or are refused.

About NovAtel (belongs to Hexagon)

NovAtel develops global navigation satellite system receivers and related hardware and software used in precision positioning applications. As part of Hexagon, the company supplies components and systems to sectors that rely on accurate location data, including transportation, agriculture, and defense. Organizations holding technical specifications, customer configurations, and operational records in these fields can become targets because the information supports critical functions.

What was likely exposed

The listing refers only to internal files. No inventory of specific documents or categories has been published, and the company has not confirmed the contents. Organizations of this type routinely maintain engineering records, customer data, and internal communications; however, whether any of these categories were taken in this case is unconfirmed.

• Internal files referenced in the listing
• No confirmed categories or record counts
• Number of affected individuals unknown

What's at stake

Exposure of internal files can reveal technical details, business relationships, or operational procedures that are not intended for public view. For individuals whose information appears in such files, the main risks involve follow-on fraud or targeted phishing if contact data is present. For the organization, the incident adds to the operational costs of investigation, potential remediation, and any regulatory notifications that may be required.

Were you affected?

Because the number of individuals involved has not been disclosed, anyone who has interacted with NovAtel or Hexagon products should monitor their accounts for unusual activity and review privacy statements from the company for any future notifications. A practical first step is to run a free exposure scan of your email address against known breach data to check whether your information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.