NovAtel (belongs to Hexagon) Listed by qilin Ransomware Group

On November 24, 2025, industrial technology company NovAtel, a subsidiary of Hexagon, appeared on the leak site of the qilin ransomware group. The attackers claim to have exfiltrated internal files and are threatening to publish them if their demands are not met. Anyone whose personal information, employee records, or customer data passed through NovAtel’s systems could now be at risk of identity theft, phishing, or doxxing.

What's Publicly Reported from Reporting

Public reporting indicates that qilin listed NovAtel on its data-leak portal and posted samples of allegedly stolen internal documents. The exact number of files and the specific types of data remain unclear, but ransomware groups in this category routinely harvest employee personal information, vendor contracts, financial spreadsheets, and customer databases. No confirmed victim count has been released, and Hexagon has not yet issued a detailed public statement on the scale of the breach.

NovAtel specializes in GPS and positioning technology used in agriculture, defense, surveying, and autonomous vehicles. Any breach of its internal systems therefore touches a wide range of downstream organizations and individuals whose data may have been stored in shared folders or email archives.

Why This Matters for You and Your Family

When a company like NovAtel loses control of internal files, the information often includes names, addresses, phone numbers, email accounts, and sometimes Social Security numbers or dates of birth of employees, contractors, and customers. Once that data reaches a ransomware leak site, it becomes freely available to identity thieves, stalkers, and scammers.

Your family’s exposure does not require you to have done business directly with NovAtel. If you or a relative worked at a partner company, received services from a vendor that used NovAtel technology, or simply appeared in a contact list inside one of the stolen files, your information may already be circulating. Credential leaks of this kind frequently cascade into gaming accounts belonging to you or your children, turning a corporate breach into a personal doxxing incident.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at dumping raw files. They or subsequent buyers map relationships between corporate emails, personal handles, phone numbers, and real-world identities. A single leaked work address can link to your home, your children’s schools, and their online usernames. What begins as an employee spreadsheet can rapidly become a complete profile used for targeted phishing, SIM-swapping, or extortion.

Credential leaks like this one are especially dangerous for gaming accounts. Children often reuse passwords or security questions tied to family information. Once those credentials surface, account takeovers follow, exposing chat logs, location data, and payment methods that further expand the identity chain.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group’s emergence to mid-2022. The gang has since hit hospitals, manufacturers, technology firms, and local governments. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by aggressive data exfiltration before encryption. Qilin then demands payment and, if unpaid, publishes samples and eventually the full dataset on its leak site. The group has shown willingness to target organizations whose operations affect public safety and critical infrastructure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the NovAtel breach.
• Rotate any password you ever used at NovAtel or Hexagon anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The NovAtel incident is a reminder that corporate ransomware attacks quickly become personal threats to anyone whose information ends up in the stolen files. Acting quickly on the exposure you can see—and continuously monitoring for the exposures you cannot—remains the most practical defense. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.