TEPAS Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by listing them on leak sites and threatening to publish stolen data if demands are not met. In this landscape, even mid-sized corporate groups can find themselves named publicly with limited verified detail available at first. On 30 March 2025, TEPAS appeared in such a listing attributed to the qilin ransomware group, which claimed internal files had been taken and set a short deadline for contact before publication.

Public information remains sparse: the number of people affected is unknown, and the precise contents of the material have not been independently confirmed. What is known is the claim of exfiltration during a ransomware attack and the group’s stated 48-hour window. For anyone connected to TEPAS or its subsidiaries, the listing itself is reason to pay attention and take basic protective steps while fuller details emerge.

Breaking down the breach

According to the available record, TEPAS was listed by the qilin ransomware group on 30 March 2025. The group stated that internal files had been exfiltrated in a ransomware attack and that the company had 48 hours to make contact before the data would be published. No further technical details—such as the initial access method, the exact volume of data, encryption status of systems, or confirmation of any ransom payment—have been disclosed in the public summary.

The number of individuals potentially affected is listed as unknown. There is no independent verification yet of whether systems were restored, whether the threat of publication was carried out, or what specific internal material was involved. At this stage the incident is known primarily through the group’s leak-site claim rather than through detailed statements from the organisation or forensic reports released publicly.

The group behind it: qilin

Qilin is a ransomware operation that has been active in the broader cyber-crime ecosystem for several years. Like many such groups, it typically combines data theft with encryption of victim systems and then uses dedicated leak sites to name organisations and threaten publication of stolen material if negotiations fail. Public reporting on qilin has described a ransomware-as-a-service model in which affiliates carry out attacks and share proceeds with the core operators.

The group has previously been associated with attacks across multiple sectors and countries, often publicising victims after short deadlines. In this case the listing of TEPAS is presented as a claim by the group: it asserts that internal files were taken and that a 48-hour contact window was given. No additional statements from qilin specifically about TEPAS beyond that claim appear in the available facts, and independent confirmation of the full scope remains limited.

Who is TEPAS?

TEPAS refers to Tepas AS, a corporate group based in Trysil, Norway. The group comprises various subsidiaries, including Tepas Industrier, Tepas Kompetanse, Trysil Snow System, and several cleaning-service companies. Organisations of this type typically manage operational records, employee information, client or contractor details, and internal business documents across industrial, training, snow-system, and facilities-management activities.

A breach affecting such a group is consequential because the subsidiaries serve local and regional customers and employ staff whose personal and professional data may be held in shared systems. Even without confirmed large-scale consumer data exposure, disruption or leakage of internal files can affect business continuity, supplier relationships, and the privacy of people whose information appears in those files.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific categories of personal data, financial records, or customer lists—has been publicly named or independently verified. Exact contents therefore remain unconfirmed.

Corporate groups of this kind commonly hold employee records, payroll and HR documents, contracts, operational plans, and correspondence with clients or partners. Whether any of those categories were among the files claimed by qilin is not established in the public record. Readers should treat the exposure as involving internal material of undetermined sensitivity rather than assuming particular data types were confirmed stolen.

The real-world impact

For individuals whose details may appear in TEPAS internal files, the practical risks include potential misuse of contact information, employment data, or other personal identifiers if the material is published or sold. Identity-related fraud, targeted phishing, or social-engineering attempts can follow from such leaks, even when the full dataset is not yet public. Because the number of people affected is unknown, the scale of any such risk cannot yet be quantified.

For the organisation, the consequences can include operational disruption from the ransomware event itself, reputational harm from the public listing, possible regulatory scrutiny under data-protection rules, and the cost of investigation and remediation. The 48-hour deadline claimed by the group adds time pressure, though whether publication ultimately occurred is not stated in the available facts. Both the company and any affected individuals face uncertainty until more verified information is released.

What to do if you're exposed

If you have a connection to TEPAS or its subsidiaries—as an employee, contractor, client, or partner—treat the listing as a prompt for caution. Monitor bank and credit activity for unusual transactions, be alert to unexpected emails or calls that reference the company, and consider changing passwords on accounts that may have used work-related credentials. Enable multi-factor authentication wherever it is available. Keep records of any suspicious contact and report confirmed fraud to the relevant authorities.

Because public detail on this incident is still limited, checking whether your own email address has already appeared in known breach datasets can provide an early signal. Free exposure scans of your email are a practical first step; they do not replace official notifications from the organisation but can help you decide whether further monitoring or password changes are warranted while waiting for more confirmed information.

AICompiled with AI assistance from public sources and published under our editorial standards.