VM Racing Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 13 July 2025, the ransomware group known as qilin publicly listed VM Racing on its leak site, claiming it had hacked the company and taken a large volume of internal files. For customers, staff, suppliers and anyone who has shared personal or payment details with a specialist sports retailer, the practical question is straightforward: whether those records now sit outside the company’s control and what that could mean for privacy, fraud risk and day-to-day trust.

Public detail remains limited. The number of people affected is unknown, and the exact contents of the files have not been independently confirmed. What is known is the group’s claim of a successful ransomware attack involving data exfiltration, and the fact that VM Racing operates in a sector that routinely handles customer, order and operational information.

Inside the incident

According to the listing reported on 13 July 2025, qilin stated that it had hacked VM Racing and obtained 1,041,539 files amounting to 83 GB. The group described the material as internal files exfiltrated in a ransomware attack. No independent confirmation of the intrusion method, the precise date of the attack, or whether systems were encrypted in addition to data being copied has been published in the available record.

The scale of people affected is listed as unknown. Beyond the group’s own figures for file count and data volume, further technical detail—such as how access was gained, how long the attackers remained inside the network, or whether backups or other systems were involved—has not been disclosed in the public summary.

The group behind it: qilin

qilin is a well-documented ransomware operation that has appeared in multiple public breach listings over recent years. Like many contemporary ransomware groups, it typically follows a double-extortion model: encrypting systems where possible while also exfiltrating data and threatening to publish it if a ransom is not paid. The group maintains a leak site on which it names victims and, in some cases, releases samples or full archives of stolen material.

Public reporting on qilin has associated it with attacks across a range of industries, often using common initial-access techniques such as compromised credentials, phishing or exploitation of known vulnerabilities, followed by lateral movement and data theft. In this case, the only specific claim about VM Racing is the one posted on the leak site: that the group hacked the company and obtained more than a million files totalling 83 GB. That listing should be treated as an unverified claim by the threat actor rather than as independently verified fact.

VM Racing and its sector

VM Racing is described as a retail company specialising in sports merchandise and equipment, with a focus on goods related to the motorcycle sector. Organisations of this type typically sell products online and through physical or partner channels, process customer orders and payments, manage inventory and supplier relationships, and maintain staff and logistics records.

A breach involving a specialist retailer can be consequential because the business sits at the intersection of consumer data, payment flows and operational systems. Even when the precise files taken are not confirmed, the combination of customer-facing retail activity and back-office operations means that personal, financial and commercial information may all be present in internal systems. For a niche sports and motorcycle merchandise business, that can include contact details, order histories, loyalty or account data, and supplier or employee records—information that, if misused, can affect both individuals and the company’s ability to operate normally.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. The group claims a total of 1,041,539 files (83 GB). No further breakdown of data types—such as customer databases, payment card data, employee records or contracts—has been named in the public summary. Exact contents therefore remain unconfirmed.

Retailers of sporting and motorcycle goods typically hold customer names, addresses, email and phone numbers, order and shipping details, account credentials, and sometimes payment-related information processed through third-party gateways. They also commonly store staff records, supplier agreements, inventory data and internal correspondence. Whether any of those categories were among the files claimed by qilin has not been independently verified. Until more detail is released or confirmed, it is accurate only to say that internal files were reported as taken and that the precise mix of personal and business data is unknown.

What's at stake

For people who have dealt with VM Racing, the main risks are the usual consequences of internal data leaving an organisation’s control: possible misuse of contact or account details for phishing or social engineering, exposure of order or address information that could support identity-related fraud, and longer-term uncertainty about whether personal data will appear in later dumps or sales. Because the number of affected individuals is unknown and the file contents are unconfirmed, it is not possible to say how many people, if any, face concrete harm.

For the organisation itself, a public ransomware listing can bring operational disruption, reputational damage, potential regulatory scrutiny depending on jurisdiction, and the cost of investigation and remediation. Concrete points that matter in practical terms include:

• Uncertainty over whether customer or staff personal data was among the claimed 1,041,539 files.
• The possibility that contact or order information could be used in targeted scams.
• Ongoing risk that the group may publish or sell material if its demands are not met.
• The need for the company to establish what was actually accessed and to notify affected parties if required by law.

What to do if you're exposed

If you have an account, past orders or other dealings with VM Racing, treat the situation as a precautionary matter rather than confirmed personal compromise. Change any password you reused on the site, enable multi-factor authentication where available, and watch bank and card statements for unexpected activity. Be sceptical of unexpected emails, messages or calls that reference your orders or personal details; verify any request through official channels you already trust. Consider placing fraud alerts with relevant credit or identity services if you are concerned that more sensitive data may have been involved.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. That check will not prove or disprove involvement in this specific incident, but it can show whether the same email has surfaced elsewhere and help prioritise further steps such as password changes and monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.