Alu Perpignan Listed by qilin Ransomware Group

On October 14, 2025, French company ALU Perpignan appeared on the leak site of the qilin ransomware group, with internal files exfiltrated during a ransomware attack. The company, which provides PVC and aluminum windows, doors, and joinery for homes and businesses across the Perpignan region, joins a growing list of small and mid-sized organizations whose customer and operational data may have been exposed in similar incidents.

Reported Details of the Breach

Public reporting indicates that qilin actors gained access to ALU Perpignan’s systems, encrypted data, and later published a sample of the stolen files on their dark-web leak portal. The exact number of records involved remains unknown, but the exposed material consists of internal files that typically include customer contracts, contact details, invoices, and project specifications in the building and renovation sector. No evidence has surfaced that payment-card data or medical records were taken, yet the presence of names, addresses, phone numbers, and email addresses tied to both residential clients and business partners creates immediate privacy risks.

Available reporting describes the incident as following the group’s standard double-extortion model: first locking the victim’s systems, then threatening to release the data unless a ransom is paid. As of the publication date on the leak site, it is unclear whether ALU Perpignan made any payment or engaged with the attackers.

Why This Matters for You and Your Family

When a local company that has worked on your windows, patio, or home extension suffers a breach, your personal information can end up in the hands of criminals. Customer names, home addresses, phone numbers, and email addresses are exactly the building blocks needed for identity theft, phishing campaigns, or physical intimidation. If you or your family have ever hired ALU Perpignan or similar trades firms, your details may now be circulating in criminal forums where they can be combined with other leaks.

Children’s information is sometimes included in family project files—school-run addresses, guardian contact details, or even notes about occupancy patterns. Once these records leave the company’s control, you lose the ability to limit how they are used or sold.

The Doxxing and Identity-Chain Risks

A single breach rarely stays isolated. Criminals use leaked customer lists to cross-reference usernames, email addresses, and phone numbers against gaming platforms, social media, and data-broker profiles. This process, known as identity-chain mapping, can quickly link your professional renovation records to your child’s Roblox or Fortnite account, revealing full names, current addresses, and family relationships. The result is doxxing that escalates from nuisance spam to targeted harassment or extortion.

Credential leaks like this one cascade into account takeovers when the same password appears in multiple places. A contractor’s invoice that lists an email address and a reused password gives attackers a direct path into personal accounts that protect far more sensitive data than the original renovation project.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group with emerging in 2022 and targeting organizations of all sizes across Europe and North America. Notable prior victims include healthcare providers, manufacturers, and local government entities. The group’s typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files and deployment of ransomware. They then list non-paying victims on their leak site with countdown timers, pressuring organizations to pay to prevent full data dumps. Exact success rates are difficult to verify, but the volume of companies listed each month shows a persistent and expanding operation.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used with ALU Perpignan or similar contractors, and switch on 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own devices and accounts.

The ALU Perpignan breach is a reminder that even routine transactions with local tradespeople can expose your family’s information to professional cybercriminals. Taking concrete steps now limits how far that data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to the same credential-stuffing chains seen in incidents like this.