Rihatec Systemlösungen Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized industrial and engineering firms across Europe, using data theft and public leak-site pressure as core tactics. In this environment, even specialised manufacturers can find themselves listed by operators who claim to have stolen internal material. On 3 October 2025, the ransomware group known as qilin publicly listed Rihatec Systemlösungen, a Munich-based company that builds control cabinets and automation solutions. The number of people affected remains unknown, and public detail is limited to the claim that internal files were exfiltrated. For clients, suppliers and employees in the DACH region, the listing raises practical questions about what may have been taken and what steps are sensible now.

This article sets out only what is known from the reported listing, places the actor in context, and explains the ordinary risks that arise when an industrial automation firm is named on a ransomware leak site.

What happened

According to the public record, Rihatec Systemlösungen was listed by the qilin ransomware group on or around 3 October 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further Reported Details have been released about the date of intrusion, the method of access, the volume of data, or whether encryption was also deployed. The number of people affected is unknown. Public reporting summarises the company as a specialist in control cabinets and automation solutions for machines and systems, based in Munich and serving clients in the DACH region. Beyond the leak-site claim itself, no independent confirmation of the breach’s full scope has been made available in the material reviewed for this article.

Because the listing is an assertion by the threat actor, it should be treated as a claim rather than verified fact until the organisation or competent authorities provide additional information. Timing, scale and technical method remain undisclosed.

Who is qilin?

Qilin is a ransomware operation that has been active for several years and is widely documented as operating a ransomware-as-a-service model. Affiliates typically gain access to networks, steal data, and then deploy encryption while threatening to publish the stolen material if a ransom is not paid. The group maintains a dark-web leak site on which it names victims and, in some cases, releases sample files or larger archives. Public reporting has associated qilin with attacks on manufacturing, professional services and other mid-market organisations across multiple countries. Its tactics commonly include double extortion—combining encryption with the threat of data publication—and the use of standard remote-access and living-off-the-land techniques once initial access is obtained.

In the present case, the only specific claim tied to Rihatec Systemlösungen is the listing itself and the assertion that internal files were exfiltrated. No additional statements attributed to qilin about this particular victim appear in the available facts, and none should be invented.

Rihatec Systemlösungen and its sector

Rihatec Systemlösungen designs and builds control cabinets and automation solutions for machines and industrial systems. Based in Munich, it serves customers across the DACH region with both standard and customisable products. Companies of this type sit at the intersection of electrical engineering, industrial automation and supply-chain manufacturing. They typically hold technical drawings, bills of materials, customer project files, supplier contracts, employee records and operational correspondence. Because their products often form part of larger production lines or critical machinery, the organisations they serve can include manufacturers, machine builders and plant operators who rely on timely delivery and accurate documentation.

A breach involving such a firm is consequential for two reasons. First, the data held is often commercially sensitive and can reveal customer relationships, pricing or proprietary designs. Second, industrial suppliers are frequently connected to larger networks of partners; compromise of one node can create secondary risk for others. The listing therefore matters not only to Rihatec itself but to the wider ecosystem of clients and suppliers that depend on its work.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in a ransomware attack.” No inventory of specific document categories, file counts or personal-data fields has been published. Organisations that design and manufacture control cabinets and automation systems commonly store engineering drawings, configuration files, customer orders, invoices, employee personnel data, email archives and supplier information. Whether any or all of these categories were among the material claimed by qilin is unconfirmed. Exact contents remain undisclosed, and no assumption should be made that particular personal or commercial records were taken.

The real-world impact

For individuals whose details may appear in the company’s internal files—employees, contractors or contacts at client and supplier organisations—the principal risks are identity misuse, targeted phishing and social-engineering attempts that reference genuine project or company details. Even without confirmed personal-data exposure, the mere fact of a ransomware listing can prompt opportunistic fraudsters to contact people associated with the firm. For the organisation, the consequences include potential disruption of operations, costs of investigation and recovery, possible contractual notifications to customers, and reputational pressure arising from the public claim. Because the scale of the incident is unknown, the precise severity cannot be quantified from public information alone.

In concrete terms, affected parties may face increased scrutiny of invoices, unexpected password-reset requests, or emails that appear to come from trusted colleagues. The organisation itself may need to review access controls, notify partners where required by contract or law, and monitor for further leakage. None of these outcomes is automatic; they depend on what was actually taken and how the material is later used—details that remain unconfirmed.

Were you affected?

If you are an employee, former employee, client contact or supplier of Rihatec Systemlösungen, treat the listing as a reason for heightened caution rather than confirmed personal compromise. Change passwords for any accounts that may have been used in correspondence with the company, enable multi-factor authentication where available, and be sceptical of unsolicited messages that reference internal projects or request urgent payments or credentials. Monitor financial statements and credit activity for unusual activity. If you receive notification directly from the company, follow the instructions it provides.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it can indicate whether the address has surfaced elsewhere and help prioritise further protective steps. Public detail on this event remains limited; any additional official statements from the organisation or authorities should be preferred over unverified claims circulating online.

AICompiled with AI assistance from public sources and published under our editorial standards.