Surface 678 Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms of every size, treating even specialised practices as sources of leverage through stolen files and public pressure. Against that backdrop, the landscape architecture firm Surface 678 appeared on a ransomware leak site in late February 2025, an event that has drawn attention because the group involved claims it will soon release the company’s internal data.

Public reporting states that Surface 678 was listed by the qilin ransomware group on 26 February 2025. The listing asserts that internal files were exfiltrated and that “all data of this company will be available for download on 7.03.2025.” The number of people affected remains unknown, and independent confirmation of the intrusion or the precise contents of the stolen material has not been published. For clients, partners and staff of a firm that has operated since 1993, the claim alone is enough to warrant careful attention.

Breaking down the breach

According to the available record, Surface 678 was named on a qilin-associated leak site on 26 February 2025. The group’s own statement describes the incident as a ransomware attack in which internal files were taken and asserts that the full set of company data would be offered for download on 7 March 2025. No further technical detail—such as the initial access vector, the encryption status of systems, or any ransom demand—has been disclosed in the public summary.

The scale of the incident is likewise unconfirmed. The number of individuals whose information may have been involved is listed as unknown. Beyond the generic description “internal files,” no inventory of folders, file counts or specific document categories has been released by either the firm or independent researchers. The listing itself remains an unverified claim by the threat actor; no third-party forensic confirmation has been made public at the time of writing.

The group behind it: qilin

Qilin is a ransomware operation that has been active for several years and is widely documented as a ransomware-as-a-service (RaaS) group. Like many of its peers, it typically employs a double-extortion model: encrypting systems while simultaneously exfiltrating data, then threatening to publish the stolen material if payment is not made. Affiliates of the group are known to target organisations across multiple sectors, often using commodity initial-access techniques followed by lateral movement and data staging before encryption.

Public reporting on qilin has noted its use of dedicated leak sites to name victims and post sample files or full archives. The group’s listings frequently include short descriptive text about the victim organisation, sometimes drawn from the organisation’s own website. In the present case, the leak-site entry for Surface 678 includes language that appears to originate from the firm’s public description of its work. No additional claims specific to this victim—beyond the assertion of data exfiltration and the stated publication date of 7 March 2025—have been recorded in the available facts.

About Surface 678

Surface 678 is a landscape architecture firm founded in 1993. Public materials describe it as dedicated to design excellence and the integration of natural systems and craft into its projects. Firms of this type typically maintain project files, client correspondence, design drawings, contracts, financial records and employee information. Because landscape architecture work often involves public-sector clients, private developers and multi-year site plans, the firm’s digital holdings can include both commercial and personal data accumulated over decades of practice.

A breach affecting such an organisation is consequential precisely because the data it holds is rarely limited to a single category. Design files may contain proprietary methods or site-specific details; client records may include contact information and contractual terms; internal administrative systems may store payroll or human-resources material. Even when the precise contents of an alleged theft remain unconfirmed, the potential exposure of any of these categories creates practical risk for the firm’s clients, staff and partners.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the material included client lists, financial documents, employee records or design archives—has been disclosed. The group’s statement that “all data of this company” would be made available is a claim, not an independently verified inventory.

Organisations of this kind commonly store project documentation, contracts, invoices, email archives and personnel files. Whether any or all of those categories were among the files taken remains unconfirmed. Readers should therefore treat the exact contents of the alleged breach as unknown until the firm or a competent investigator provides additional detail.

The real-world impact

For individuals whose information may have been present in the firm’s systems, the primary risks are secondary misuse of personal or professional data—identity fraud, targeted phishing, or unsolicited contact that leverages knowledge of past projects. Because the number of people affected is unknown and the specific data types are unconfirmed, the concrete exposure for any single person cannot yet be quantified.

For Surface 678 itself, the listing creates reputational and operational pressure. Even if systems were restored without paying a ransom, the possibility that internal files will appear online can complicate client relationships, regulatory obligations and insurance discussions. The firm may also face the ordinary costs of incident response, forensic review and notification if personal data is later shown to have been involved. None of these outcomes has been publicly confirmed; they remain the ordinary consequences that follow a claimed ransomware event of this type.

If your data was in this claimed breach

If you have worked with Surface 678 as a client, contractor or employee, treat the listing as a prompt to review your own exposure rather than as proof that your records were taken. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where it is not already in place, and be alert to phishing messages that reference landscape projects or the firm’s name. Consider placing a fraud alert with credit bureaus if you believe sensitive personal identifiers may have been stored by the firm.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Such a scan will not confirm or deny involvement in this specific incident, but it can indicate whether your credentials or contact details have surfaced elsewhere and help you prioritise password changes and further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.