Merko Ehitus Listed by qilin Ransomware Group

On December 15, 2025, Estonian construction company Merko Ehitus appeared on the leak site of the qilin ransomware group, which claims to have stolen and is prepared to publish the firm’s internal files.

What Public Reporting Shows

Public reporting indicates that Merko Ehitus was listed on the qilin leak portal with an announcement that internal data had been exfiltrated during a ransomware incident. The exact number of files or their specific contents has not been independently verified by third parties, and the company has not yet issued a detailed public statement on the volume or sensitivity of the material. Available reporting describes the listing as part of qilin’s standard double-extortion process, in which the group first demands ransom for decryption and non-disclosure, then threatens public release if payment is not made.

Internal files are the category of data described as stolen. No customer personal data, payment card details, or employee records have been confirmed as exposed in open summaries, though the broad term “internal files” in ransomware incidents frequently includes contracts, employee information, financial spreadsheets, and operational documents.

Why This Matters for You and Your Family

When a company that builds homes, offices, and public infrastructure is hit, the information stolen can easily include contracts containing your address, phone number, email, or the names of family members. Even if you never directly interacted with Merko Ehitus, supply-chain leaks like this often ripple outward. Partners, subcontractors, and clients end up in the same datasets. Once those records reach criminal marketplaces, anyone can buy them and begin linking your details across other breaches.

Credential leaks from construction and engineering firms frequently contain reused work passwords that people also use for personal email, banking, or online shopping. A single exposed spreadsheet can give attackers the starting point they need to target you or your children.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at posting generic “internal files.” They or subsequent buyers map the data into larger identity chains — connecting work emails to personal accounts, home addresses to family members, and professional details to children’s names or school information. These chains accelerate doxxing: one leak supplies the address, another supplies the phone number, a third reveals gaming usernames. The result is a complete profile that can be used for harassment, targeted phishing, or identity theft. Public reporting on similar incidents shows that construction-sector breaches often surface months later in doxxing forums because the data is rich in physical-world identifiers that criminals prize.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group with emerging in 2022 and operating as a ransomware-as-a-service platform. The group has targeted organizations across Europe, North America, and Australia, with notable prior victims including healthcare providers, manufacturers, and local governments. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by extensive exfiltration of internal documents before encryption. Qilin then uses a double-extortion model: demanding payment for both decryption keys and a promise not to publish the stolen data. If the victim refuses, samples or full archives are posted on their leak site to pressure the target or invite third-party purchases.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have appeared in the Merko Ehitus files.
• Rotate any password you used at work or with Merko Ehitus partners anywhere it has been reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings that surface from this incident.

The incident is a reminder that construction-sector ransomware attacks now routinely expose the personal details of ordinary families who simply hired a builder or lived near a project. Starting with a DoxxScan gives you a clear picture of what is already circulating and hands the cleanup to specialists who perform continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation, and full household coverage that includes your children’s gaming accounts. Acting early limits how far attackers can travel down the identity chain that begins with this claimed breach.