The Qilin ransomware group listed UK transport company Palletline as a claimed victim on 30 October, according to threat-intelligence reporting, in the latest example of a ransomware listing moving faster than the confirmed facts. The claim was recorded by the Ransomware.live tracker at 15:30 UTC on Thursday, and threat analysts linked the incident to infostealer activity that harvested credentials before any ransomware deployment.

An exposure report cited in the reporting identified 58 passwords, including three marked critical, and nine cookies connected with the incident, alongside one compromised employee account and seven users. The organisation uses Microsoft 365 and Mailgun services, according to domain records cited by researchers. No ransom demand has been confirmed, and the reporting does not establish whether data was stolen or systems encrypted.

That caution matters. A second threat-intelligence report on the same listing stresses that the claim should be treated as unverified, with no details disclosed about the alleged intrusion, any stolen information, affected systems or ransom demands. Palletline has not, in the material reviewed, confirmed a successful attack, and a leak-site listing alone is not proof of a breach.

Why infostealer-led claims are rising

Qilin operates a double-extortion model, threatening to publish stolen data as well as encrypt files, which makes even an unverified listing damaging for the named company. Security researchers say infostealer infections, which quietly steal passwords and session cookies, have become a common first step: valid credentials let attackers walk in through legitimate logins rather than breaking through a firewall. Firms are advised to reset exposed credentials, revoke active sessions, enable phishing-resistant multi-factor authentication and check for unusual logins, rather than waiting for a victim statement or a data sample to appear.