Pergande Data Breach

On October 18, 2026, the Qilin ransomware group claimed an attack against Pergande, a company based in Germany. The threat actor listed Pergande on its extortion portal, threatening to publicly release sensitive data if ransom demands are not met. The exfiltrated data reportedly includes internal operational systems, client and partner records, and business documentation, consistent with Qilin’s double-extortion tactics which involve both encryption and data publication. This incident highlights the ongoing threat to European businesses, particularly those in Germany, a country frequently targeted due to its robust industrial and professional services sectors. Qilin has been highly active recently, claiming approximately 198 victims in the past 60 days. The ransomware group primarily targets organizations in the US, UK, and Spain, with a notable focus on the Manufacturing, Technology, and Professional Services industries. Their active targeting of European nations, including Germany and its surrounding markets, is evident in recent victimizations such as Mastelli S.r.l. in Italy and BRUTRA Logistek in the Netherlands. Pergande’s inclusion aligns with Qilin’s strategic expansion into the European market.

SOCRadar’s CTI team conducted a stealer-log analysis for Pergande’s associated domains, which returned no matching records. This indicates that no employee or business credentials linked to the organization were found within the analyzed infostealer data. While this discovery eliminates one potential pre-attack vector, it does not confirm that an intrusion did not occur or that Pergande is unaffected. The absence of exposed credentials does not rule out other common initial access methods employed by Qilin, such as phishing campaigns, exploitation of remote desktop or VPN services, or supply chain compromises through third-party vendors and partners. The lack of stealer-log findings for Pergande necessitates a continued focus on other potential intrusion pathways. Organizations operating in Germany, particularly those within Qilin’s favored sectors like Manufacturing, Technology, and Professional Services, should remain vigilant. Pergande’s listing is indicative of Qilin’s broader campaign to target European entities rather than suggesting a specific, intelligence-driven operation. Therefore, companies in this region should assume they are potential targets irrespective of any observed credential exposure. Assessment: The null stealer-log result offers a limited but valuable insight into the potential attack chain, suggesting that credential theft via infostealers may not have been the primary method of initial access for Qilin against Pergande. However, this finding does not definitively exclude other equally potent methods. German organizations, particularly those operating within Qilin’s known targeting preferences, should maintain a heightened state of alert. Pergande’s inclusion on the Qilin leak site aligns with the group’s ongoing efforts to expand its reach across Europe. Next Steps: Pergande is advised to promptly assess its notification obligations under the EU’s GDPR and Germany’s Bundesdatenschutzgesetz (BDSG). Typically, supervisory authorities must be notified within 72 hours of becoming aware of a personal data breach. Companies within critical or regulated sectors may also face additional sector-specific reporting requirements. The immediate priorities should include engaging incident response support, thoroughly determining the scope of any accessed data, and evaluating applicable regulatory timelines while simultaneously working to restore operational continuity.