Ransomware Group: QILIN

VICTIM NAME: Centralno grijanje Tuzla

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to the municipal heating provider in the city of Tuzla, Bosnia and Herzegovina. The attack was publicly disclosed on May 27, 2025, with the attack date recorded as May 26, 2025. The organization operates in the manufacturing activity sector, specifically in providing central heating services since 1977. The leaked data appears to include internal information related to the utility’s operations. The page features a screenshot of internal documents, indicating potential disclosure of confidential operational details.

The leak may also involve data or information that could impact the organization’s security or operational integrity. Accessibility to the leak is facilitated through a dedicated claim URL on the dark web, which is protected via an onion service link. The leak has been associated with a threat group named “qilin.” There are no specific details about the type of data compromised, but the presence of images suggests the leakage includes visual documentation. The victim operates in the public service sector, providing essential heating infrastructure and services to the city of Tuzla, which has historically been recognized for its reliability and quality.