Pollex Asset Management Co. Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a financial firm appears on a ransomware group's leak site, the immediate concern for clients, employees and partners is whether personal or financial details have left the organisation's control. In the case of Pollex Asset Management Co., public reporting indicates the company was listed by the qilin ransomware group on 6 September 2025, with claims that internal files were taken. The number of people affected remains unknown, and exact contents of the material have not been independently confirmed, yet the mere listing raises practical questions about exposure for anyone who has shared data with the firm.

Asset-management companies routinely handle sensitive records. Even without a full public inventory of what was taken, the possibility that internal files left the network means individuals connected to Pollex may need to watch for fraud, phishing or misuse of any information they once provided.

Inside the incident

According to available reporting, Pollex Asset Management Co. was named on the qilin ransomware group's leak site on 6 September 2025. The listing is presented as part of a series described as "Korean Leak part 10." The group claims that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data removed, or any ransom demand—have been publicly disclosed. The number of individuals whose information may be involved is listed as unknown. Independent verification of the claims has not been reported, so the listing itself remains an assertion by the threat actor rather than a confirmed forensic finding.

The group behind it: qilin

qilin is a ransomware operation that has been active for several years and is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if payment is not made. The group typically operates as a ransomware-as-a-service model, recruiting affiliates who carry out intrusions and share proceeds. Public reporting on qilin has documented attacks against organisations across multiple sectors, often accompanied by leak-site postings that name victims and sometimes sample files. In this instance, the group claims Pollex Asset Management Co. as a victim and asserts that internal files were taken; those assertions have not been independently corroborated in the available record. No specific statements by qilin beyond the listing itself are documented for this case.

Pollex Asset Management Co. and its sector

Pollex Asset Management Co. operates in the financial market. Public descriptions indicate the company invests in a variety of assets, applying professional investment and risk-management expertise with the aim of achieving optimal returns. Asset-management firms of this type typically maintain client account information, transaction histories, investment strategies, employee records and internal operational documents. Because such organisations sit at the intersection of personal wealth, institutional capital and regulatory reporting, a breach can affect both individual clients and the broader confidence placed in the firm. The Korean context noted in the leak-site description places the company within a market that handles significant domestic and cross-border capital flows, heightening the potential sensitivity of any internal material that leaves its systems.

What data was at risk

The only data type named in the available facts is "internal files" said to have been exfiltrated during a ransomware attack. No inventory of file names, categories or volumes has been released, and the number of people affected is unknown. Organisations in the asset-management sector commonly hold client identity documents, contact details, bank-account or portfolio information, tax identifiers, employee personal data and proprietary investment analyses. Whether any of those categories were among the files claimed by qilin remains unconfirmed. Public detail is limited to the group's assertion that internal material was taken; exact contents cannot be stated as fact.

The real-world impact

For individuals, the practical risks centre on the possible misuse of any personal or financial information that may have been included in the exfiltrated files. That can include targeted phishing, identity fraud or attempts to access other accounts using reused credentials or personal details. Because the scale and precise contents are undisclosed, the degree of exposure for any single person cannot be quantified from public sources. For the organisation, a ransomware listing can disrupt operations, trigger regulatory scrutiny, and require costly investigation and remediation. Even when encryption is not confirmed, the reputational and compliance consequences of claimed data theft are real. Clients and counterparties may seek reassurance or additional monitoring, and the firm itself faces the ordinary burdens of incident response without public confirmation of the full scope.

Were you affected?

If you have been a client, employee or partner of Pollex Asset Management Co., treat the listing as a prompt for caution rather than confirmed personal compromise. Monitor financial statements and credit reports for unexpected activity, enable multi-factor authentication on important accounts, and be alert to unsolicited messages that reference the firm or request sensitive information. Change passwords that may have been used in connection with the company if you have not already done so. Readers can also run a free exposure scan of their email address to check whether that address has appeared in known breach data sets; such a scan provides one additional data point but does not replace ongoing vigilance. Public information about this incident remains limited, so any further official notifications from the company or regulators should be treated as the authoritative source for next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.