WIS LOGISTICS Data Breach

Qilin listed WIS LOGISTICS on its dark web leak site on August 19, 2026. The US-based freight and logistics provider is the group’s latest American transportation target, fitting a recurring pattern of Qilin activity against US industrial operators. The listing was identified through SOCRadar’s Dark Web Monitoring service. Over the 60 days prior to this listing, Qilin has claimed approximately 196 victims. Manufacturing, Professional Services, and Technology are its dominant sectors; victims cluster most heavily in the United States, Germany, and France. Recent overlapping listings include AGUNSA (Chile, transportation), DELTA WAYS (Germany, transportation), Teikoku USA (US, manufacturing), and Double H Equipment (US, manufacturing).

Stealer-log telemetry for wislogistics[.]com returned no records in the queried dataset. That’s not a clean bill of health — credentials may exist under a sibling domain or in feeds outside this sample. For Qilin, infostealer-sourced credentials are a primary access vector: brokers pull fresh logs, validate corporate accounts, and authenticate against VPN or Microsoft 365 portals before deploying ransomware.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.