Aarsleff Data Breach

Swedish construction and industrial contracting firm Aarsleff has been listed as a claimed victim on the Qilin ransomware group’s dark web leak portal, with the listing dated September 16, 2026. SOCRadar’s Dark Web Monitoring service identified this listing. It is important to note that no breach has been independently confirmed; this report reflects Qilin’s claim rather than a verified incident. Construction and heavy contracting firms typically handle sensitive project data, vendor contracts, and employee records, making them attractive targets. If data exfiltration preceded encryption, the potential exposure could be substantial for Aarsleff. Qilin is currently identified as one of the most active ransomware operators, claiming 253 victims within the preceding 60 days. Their attacks are primarily concentrated in the Manufacturing and Professional Services sectors. The group has notably targeted companies located in the United States, Germany, and the United Kingdom. While victims based in Sweden are less common in Qilin’s publicly documented activities, Aarsleff’s inclusion suggests the group is expanding its reach into Nordic markets. This broadening scope indicates a demonstrable willingness by Qilin to target entities beyond their typical operational areas, making Aarsleff’s appearance noteworthy.

SOCRadar’s stealer-log telemetry analysis did not find any leaked credentials specifically linked to the domain aarsleff[.]se. However, this absence of data within the queried dataset does not definitively clear the organization. It is possible that credentials may exist in other data feeds not covered by this specific query, or they might have been exfiltrated using personal email accounts that are not directly associated with the corporate domain. The typical access vector employed by the Qilin group involves the use of stolen credentials, which are then validated against remote access portals such as VPNs or Microsoft 365. Following successful validation, the group proceeds with ransomware deployment. This means that even without direct evidence from the current telemetry, the potential for such an intrusion path remains a significant concern. If Aarsleff is identified as a vendor or partner within your organization’s supply chain, it is advisable to review all shared access arrangements and data exchange protocols while the Qilin listing remains unconfirmed. On an internal level, prioritizing a comprehensive audit of remote access credentials associated with aarsleff[.]se is crucial. Proactive measures taken now incur minimal cost, whereas delaying action until confirmation of a breach could lead to significantly higher repercussions.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.