Wheels and Deals Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure smaller organisations by listing them on public leak sites, turning internal disruption into a public claim of data theft. In this landscape, even local publishers can appear alongside larger targets, with limited independent confirmation of what was taken or how many people are involved.

On March 07, 2025, the ransomware group known as qilin listed Wheels and Deals, a Central Illinois automotive magazine publisher. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details have not been disclosed. The listing itself is a claim by the group; independent verification of the full scope has not been provided in available records.

What happened

According to the reported incident summary, Wheels and Deals was listed by the qilin ransomware group on March 07, 2025. The available facts state that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of people affected, and specifics such as the exact date of intrusion, the initial access method, the volume of data, or any ransom demand are not disclosed in the record. The group’s leak-site listing constitutes its claim that the organisation was compromised and that data was removed; that claim has not been independently confirmed in the facts provided. Beyond the statement that internal files were taken, further technical or forensic detail remains limited.

Inside qilin

Qilin is a known ransomware operation that has operated under a ransomware-as-a-service model. Public reporting on the group describes a pattern of double extortion: encrypting systems while also claiming to exfiltrate data, then threatening to publish or sell the material if payment is not made. The group has historically listed victims across multiple sectors on dedicated leak sites, using those postings both as pressure and as advertising for its services. Affiliates typically handle intrusion and deployment while the core operation manages negotiation and publication infrastructure. None of that general background states the precise tactics used against Wheels and Deals; the only claim specific to this incident is the group’s listing of the publisher and the assertion that internal files were exfiltrated.

About Wheels and Deals

Wheels and Deals is described as a free, 112-page automotive magazine based in Central Illinois. It is a local, family-owned publishing group established in 1978. The magazine is published weekly and distributed free of charge at numerous locations. Organisations of this type typically manage advertising relationships, distribution lists, production schedules, and day-to-day business records. A breach at a long-standing community publisher can affect not only the business itself but also the advertisers, contributors, and local readers who interact with it. Because the company operates as a free weekly title with deep regional roots, any exposure of internal material carries consequences for trust and continuity that extend beyond a single corporate network.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown of file types, databases, or personal data categories is provided, and the number of individuals whose information may be involved is listed as unknown. Organisations in the local publishing sector commonly hold employee records, advertiser contact and billing details, distribution or subscriber lists, editorial drafts, and operational documents. Whether any of those categories were among the files claimed by qilin has not been confirmed. Exact contents therefore remain unconfirmed; only the general statement that internal files were taken is on record.

What's at stake

For people whose information may have been among the internal files, the practical risks include unwanted contact, phishing attempts that reference the magazine or local automotive interests, and potential misuse of any contact or financial details that happened to be stored. Because the scale is unknown, it is not possible to say how widely those risks apply. For the organisation, a ransomware incident can interrupt production and distribution of a weekly free magazine, damage relationships with advertisers who rely on timely placement, and create lasting uncertainty about what was taken. Even when encryption is resolved, the claim of exfiltration leaves open the possibility that material could reappear later. The absence of confirmed counts or data categories means both individuals and the business must treat the situation as unresolved rather than fully measured.

Were you affected?

If you have worked with, advertised in, or regularly received Wheels and Deals, treat any unexpected messages that reference the magazine or local car sales with caution. Monitor financial and email accounts for unusual activity, and consider placing fraud alerts if you have shared personal or payment information with the publisher. Change passwords on accounts that may have used the same credentials elsewhere, and enable multi-factor authentication where available. Because the number of people affected and the precise data types remain unknown, there is no definitive public list of victims. Readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check is a practical first step while official notifications, if any, are awaited.

AICompiled with AI assistance from public sources and published under our editorial standards.