Point Four EPoS Solutions Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Point Four EPoS Solutions has been listed by the qilin ransomware group after internal files were exfiltrated in an attack. The incident was disclosed on 24 April 2026; an undisclosed number of people may be affected and should check whether their data has been exposed and take protective steps.
Breaking down the breach
The only confirmed detail is the appearance of Point Four EPoS Solutions on the qilin leak site. The group claims to have stolen internal data, but provides no count of records, no description of file types, and no timeline for when the intrusion occurred. No independent verification of the claim has been reported, and the organisation itself has not issued a public statement on the matter.
Inside qilin
Qilin is a ransomware operation that follows the double-extortion model common among current threat groups. It typically gains access through compromised remote-access services or supply-chain providers, deploys encryption on target systems, and then threatens to publish stolen material if a ransom is not paid. The group has previously listed organisations in retail, manufacturing and professional services on its leak site, though each listing remains an unverified claim until the material is independently confirmed or the victim acknowledges the incident.
Who is Point Four EPoS Solutions?
Point Four EPoS Solutions supplies electronic point-of-sale systems used by retailers and hospitality businesses to process transactions, manage inventory and record customer purchases. Companies in this sector routinely hold records that include payment-card details, customer names and addresses, staff information and internal operational documents. A compromise at such a provider can therefore touch both the business’s own data and information belonging to its client locations and their customers.
What data was at risk
The listing refers only to “internal files.” The precise categories of information contained in those files have not been disclosed. Organisations that provide point-of-sale services commonly store transaction logs, payment authorisation records, customer contact details and employee data. Without a confirmed inventory of the exfiltrated material, it is not possible to state which of these data types, if any, were taken.
Why it matters
Even when the exact contents remain unknown, the presence of a point-of-sale provider on a ransomware leak site raises the possibility that payment-related or customer records could be exposed. Individuals may face increased risk of card fraud or account takeover if their transaction details appear in any later release. For the organisation, the incident adds pressure to demonstrate that customer and operational data were protected and to meet any regulatory obligations that follow a claimed breach.
Were you affected?
Anyone who has used a retailer or venue that relies on Point Four EPoS Solutions should watch for direct contact from those businesses. Practical steps include reviewing bank and credit-card statements for unusual activity, enabling transaction alerts, and considering a credit freeze if personal financial details may be involved. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published collections.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Max Fordham Listed by qilin Ransomware GroupGlobal Retool Group Listed by qilin Ransomware GroupPorter W Yett Listed by qilin Ransomware GroupLTJ Industrial Services Breached by Qilin RansomwareLatest breaches
Publicly posted by qilin — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.