Skip to content
Leak-site post naming KMLS, captured by ThreatCluster
Back to victims

KMLS

qilin

Ransomware leak-site victim intelligence

Views
3,853
Posted
Sep 20, 2026
Country
DE
Industry
Construction

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

The leak claims data from KMLS Construction; the page lists a TOX hash value (7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68) and provides a WikileaksV2 reference, but the amount of data is not specified. Victim profile on the leak page identifies the domain www.kmls.de and the sector as Construction. The leak is published (posted 2026-09-20) by the group qilin.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

KMLS Construction

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX
7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
WikileaksV2
https://wikileaks2.com/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring a stylized hexagon with a cube inside, primarily in dark blue.
onion leak page7.7 KB

Negotiation
Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68