O.Berk Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
O.Berk has been listed by the Qilin ransomware group, with internal files reported as exfiltrated. The incident was disclosed on February 18, 2026, and an undisclosed number of people may have been affected; individuals should check whether their information was exposed and take appropriate protective steps.
On February 18, 2026, the ransomware group qilin listed O.Berk on its leak site, stating that it had obtained internal files from the organization. The number of individuals whose information may be involved remains unknown, as does the precise scope of any data that left company systems.
Public details are limited to the listing itself. No confirmation has been issued by O.Berk, and no volume of records or specific data categories beyond the group’s claim of internal files has been disclosed.
Inside the incident
O.Berk appeared on the qilin ransomware group’s leak site on February 18, 2026. The group claims to have stolen internal data during a ransomware attack. No further technical details, such as the date of intrusion, the method of initial access, or the volume of material taken, have been made public. The organization has not released a statement confirming or disputing the listing.
The group behind it: qilin
Qilin is a ransomware operation that conducts double-extortion attacks, encrypting systems and threatening to publish stolen files if a ransom is not paid. The group maintains a leak site where it lists victims and, in some cases, posts samples of claimed data. Its activity has been tracked by security researchers since at least 2022, with targets spanning multiple industries and regions. Public reporting on the group focuses on its use of affiliate operators and its practice of publishing excerpts to pressure victims.
About O.Berk
O.Berk operates as a commercial organization that maintains records typical of businesses in its sector, including employee information, customer or supplier details, and internal operational documents. Such entities routinely store data required for contracts, compliance, and day-to-day administration. A compromise of these systems can expose both personal identifiers and business-sensitive material that is not intended for external distribution.
What was likely exposed
The only information released so far is the qilin group’s claim that internal files were exfiltrated. No inventory of specific data types, file counts, or affected individuals has been published by either the group or the organization. Organizations of this kind commonly hold employee records, contact information for business partners, and internal correspondence; however, whether any of these categories were among the claimed files remains unconfirmed.
Why it matters
Internal files can contain personal data that enables identity-related fraud or targeted phishing if later published. For the organization, the incident adds the risk of regulatory scrutiny and operational disruption even if the full contents are never released. Individuals have no direct way to assess their exposure until more details emerge or the material appears elsewhere.
Were you affected?
Begin by monitoring official statements from O.Berk for any guidance on notification or support. Review financial and email accounts for unusual activity. Individuals can also run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Pacific Lamp & Supply Listed by qilin Ransomware GroupJV Equipment Listed by qilin Ransomware GroupCarton Craft Supply Listed by qilin Ransomware GroupSinomax USA Listed by qilin Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the O.Berk Listed by qilin Ransomware Group →
Publicly posted by qilin — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.