Retelit Confirms Qilin Attack Affecting Three Data Centers; Leaked Files Reported
Summary
IrpiMedia reports that Qilin attacked Retelit, affecting three data centers and exposing internal files. Retelit confirmed the June 8 incident and says forensic analysis of possible data exfiltration is ongoing.
Key points
- Retelit said the attack attributed to Qilin occurred on June 8 and affected part of its virtualization infrastructure in three of its 38 data centers, about 7% of its data-center systems.
- IrpiMedia reports that Qilin published at least 300 GB of internal documents, including passports, supplier lists, company information and client-related files; Retelit says evidence is compatible with data exfiltration and analysis continues.
- According to a source cited by IrpiMedia, attackers allegedly obtained a system administrator’s passwords and used them to move laterally; the article says security monitoring did not detect activity in time.
- A Retelit customer told IrpiMedia that restoration from backups was only partial. Other customers reportedly described incomplete restoration or data loss.
- Retelit said it notified affected customers and relevant authorities, coordinated with ACN and CSIRT, and used incident-response specialists to contain the attack.
- IrpiMedia reports the incident was disclosed to public-administration security officials on July 30; the article says some Retelit customers had sought information about the incident.
Article Details
- Victim Organization
- Retelit
- Incident Type
- Ransomware attack involving server encryption, credential theft, lateral movement, and data exfiltration
- Incident Date
- 2026-06-08
- Disclosure Date
- 2026-08-04
- Data Types Exposed
- Passports
- Supplier lists
- Company management information
- Contracts, projects, and presentations concerning customers
- Affected Records
- Unknown
- Affected Data Size
- At least 300 gigabytes of documents were reported published; this amount is based on an automated estimate in the article.
- Operational Impact
- Retelit said the incident affected a limited part of its virtualization infrastructure in 3 of 38 data centers, about 7% of systems distributed across its data centers. The article identifies the affected centers as Verona, Rome, and Milan. Some servers were encrypted. Customers reported backup restoration was partial; one reported a 70% restoration, while another said information in a data center was irretrievably lost. Retelit said it contained the attack and coordinated recovery with authorities and specialists.
- Ransom Or Extortion
- Qilin published stolen documents. The article says the ransom was apparently not paid, but does not report a specific ransom demand or payment confirmation.
- Claim Status
- confirmed