Questica Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Questica was listed on a ransomware group's leak site on December 28, 2025. The listing indicates that internal files were taken during a ransomware operation, though the number of people affected and the precise contents of the data remain undisclosed. This development matters because Questica works with public-sector clients whose records often contain financial and operational details. Any confirmed exposure of such material would require affected organizations to assess downstream risks to their own systems and constituents.

Breaking down the breach

The only confirmed information is that Questica appeared on the qilin ransomware group's leak site on December 28, 2025. The group claims to have exfiltrated internal files during a ransomware attack. No details on the timing of the intrusion, the volume of data taken, or the method of initial access have been made public. The number of individuals whose information may be involved is also unknown.

Who is qilin?

Qilin is a ransomware operation that follows a double-extortion model. It encrypts systems and then threatens to publish stolen files on a dedicated leak site if a ransom is not paid. The group has listed victims across multiple countries and industries in recent years, using the public posting of data samples as leverage. Its listings are claims made by the actors themselves and are not independently verified at the time of publication.

Who is Questica?

Questica develops budgeting, forecasting, and performance-management software used primarily by government agencies, municipalities, and nonprofit organizations. These platforms process financial plans, grant information, and operational metrics that support public-fund allocation. A compromise at such a vendor can therefore touch records belonging to multiple public entities rather than a single private company.

What data was at risk

The facts released so far state only that internal files were taken. The exact categories of information contained in those files have not been disclosed. Organizations in this sector commonly store budget documents, vendor contracts, employee records, and client financial data, but it is not confirmed whether any of these specific types were among the material claimed by the group.

What's at stake

For individuals, the main concern is the potential misuse of any personal or financial identifiers that may have been present in the exfiltrated files. For the organizations that rely on Questica's software, the incident raises questions about the security of shared planning data and the need to review access controls and downstream dependencies. Because the scale of exposure remains unknown, the practical impact cannot yet be quantified.

If your data was in this claimed breach

Begin by monitoring accounts for unusual activity and enabling multi-factor authentication where available. Request any notifications or guidance issued by Questica or the client organizations that use its platform. Individuals can also run a free exposure scan of their email address against known breach data to check for prior appearances in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.