[QILIN] – Ransomware Victim: Wassa, SRO

AI Generated Summary of the Ransomware Leak Page

On 2025-10-19, a leak post attributed to the ransomware group qilin identifies Wassa, SRO as the victim. The metadata places the victim in the Czech Republic (CZ) but does not provide a clear industry category. The body excerpt is a lengthy, English-language profile of the company rather than a straightforward encryption notice; it describes Wassa, SRO as a Czech enterprise established in 2012 that operates a sheltered workshop with more than 100 protected positions and offers “facultative compensation” to reduce penalties for not employing the statutory number of handicapped citizens. The text emphasizes compliance with local employment law, states that facultative compensation can reach up to 50 million CZK, and argues that health status should not be a barrier. It further touts ISO 9001 and ISO 14001 certifications, ongoing internal and external audits, and a commitment to environmental stewardship, including Green Dot membership. The excerpt also mentions a collaboration with a Liberec-based research institute to optimize packaging technologies and notes that the amount of downloaded data is unknown at the moment and will be added later. A claim URL is indicated on the page, consistent with leak-site practices, and the post includes three attached images, described only in general terms.

The page presents three image attachments (likely screenshots or documents) as part of the post, hosted on a Tor onion service, though the exact contents are not described in the excerpt. Contact channels appear in the data, including a Jabber address and a TOX fingerprint, and there is an FTP address listed with credentials; however, personally identifiable information is redacted in the public copy. All URLs and onion references have been defanged for safety. The post does not explicitly state whether the attack resulted in encryption or a data leak, and there is no disclosed ransom amount in the provided text; the date on the page serves as the post date since no explicit compromise date is given. Taken together, the page mirrors a ransomware-leak post format that ties a victim identity to a group label, an accompanying claim mechanism, and visual attachments, while the precise operational impact on Wassa, SRO remains unclear from the excerpt.