SILIKO d.o.o. Data Breach

Aoqin ransomware listed SILIKO d.o.o., a Slovenian manufacturer, on its dark web leak portal on November 4, 2026, in a listing identified through SOCRadar’s Dark Web Monitoring service. The claim places SILIKO within a cluster of four Aoqin victims published simultaneously and marks the first victim from Slovenia that the group has claimed. The listing has not been independently verified. Aoqin is a small but active ransomware operator, with 4 victims claimed in the 60 days prior to this listing. Its targets span Professional Services, Technology, and Energy & Utilities, spread across the United States, China, and Chile. SILIKO was published alongside Goldsmith & Hull (United States), Nextron Technology (China), and Petroshahd/Enap Sipetrol International (Chile), a simultaneous publication pattern that suggests Aoqin batches victims and publishes in waves rather than listing them incrementally. SILIKO is unusual for the group: neither Slovenian targets nor Manufacturing sector companies appear in Aoqin’s prior known profile. This raises two possibilities — the group is expanding its targeting scope, or SILIKO was an opportunistic compromise caught in a broader campaign.

SOCRadar’s stealer-log telemetry returned no records for the siliko.si domain. This result means that no exposed employee credentials tied to the company’s domain turned up in the sampled dataset that was queried — it does not mean that none exist. Stealer logs are fragmented across markets, and records relevant to SILIKO may reside in feeds outside the queried dataset. Manufacturing-sector employees often access corporate systems via personal email aliases or ERP portals that fall outside the queried domain scope, so exposed credentials could exist under addresses or access points that a domain-based query would not surface. An empty result is therefore an absence of evidence, not evidence that no compromise occurred. For executives and security teams, the absence of credentials in this query does not change the organization’s risk posture. Monitoring and credential hygiene remain the right response. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks, and review for records under alternate corporate domains or personal email aliases are consistent with the limitations identified above, since credentials exposed through other feeds or aliases would not have appeared in this domain-scoped query. Finally, the leak-site listing has not been independently verified. Organizations with supply-chain or partnership exposure to Central and Eastern European manufacturers should log this incident and assess direct risk to their own environments rather than treating the claim as a confirmed breach.