The Qilin ransomware group has listed Mexican company XK NET SA de CV as a new victim, according to threat intelligence reports published on 7 November 2026. The claim appeared on the group's leak site that evening and was picked up by the Ransomware.live tracker.

The listing is an unverified claim by the attackers, not a confirmed breach. Neither report gives details of how the attackers first got in, whether company systems were encrypted, what data may have been taken, or whether a ransom was demanded. The company, which operates under the domain xknet.mx, has not publicly confirmed an incident.

What the trackers recorded

What the reports do agree on is the trail behind the listing. The compromise was identified through infostealer activity detected by HudsonRock, and an exposure report from ParanoidLab records 279 exposed passwords, none of them marked critical, along with 64 compromised user accounts. The tracker lists three external attack-surface findings for the domain.

Why the claim matters

The XK NET listing was reported on the same day as a separate Qilin claim against Brazilian drug firm Roxfarma and a Rhysida claim against a Brazilian state court, underlining how busy Qilin's leak site has been this week. Organisations connected to XK NET should treat the listing as an early warning: check for exposed credentials, reset any that match, and watch for follow-on phishing using the stolen details. Until the company or investigators confirm what happened, the listing should be treated as an allegation, not a confirmed breach.

[Source: undercodenews.com](https://undercodenews.com/qilin-claims-xk-net-sa-de-cv-in-latest-ransomware-disclosure-as-rhysida-targets-brazilian-court-video/) | [Source: ransomware.live](https://www.ransomware.live/id/WEsgbmV0IFNBIGRlIENWQHFpbGlu)