TEPAS Listed by qilin Ransomware Group

On March 30, 2025, Norwegian company Tepas AS appeared on the leak site of the qilin ransomware group with a 48-hour ultimatum: contact the attackers or face publication of its internal files.

What's Publicly Reported from Reporting

Public reporting indicates that Tepas AS, a corporate group headquartered in Trysil, Norway, was hit by a ransomware incident. The group includes subsidiaries such as Tepas Industrier, Tepas Kompetanse, Trysil Snow System, and multiple cleaning service operations. Available reporting describes the data at risk as internal files that were allegedly exfiltrated during the attack. The qilin leak page explicitly gave the company 48 hours to negotiate before the stolen material would be published. The exact number of people whose information is contained in the files remains unknown, and it is not yet clear which specific types of documents were taken.

Why This Matters for You and Your Family

When a company like Tepas suffers a breach, the information exposed often includes details that can be traced back to customers, employees, suppliers, or partners. If your name, address, phone number, email, or financial records appear in those internal files, the consequences can reach your household directly. Credential leaks from corporate networks frequently cascade into personal account takeovers, especially when the same passwords are reused at home or on your children’s gaming accounts. Once attackers have a foothold, they can map connections between work data and family life, increasing the risk of identity theft, phishing, or harassment that affects everyone living at your address.

The Doxxing and Identity-Chain Implications

Stolen internal files rarely stay isolated. Attackers routinely cross-reference employee or customer records with data from previous breaches, social media, and public sources to build detailed identity chains. A single leaked work email can link to your personal accounts, phone numbers, family member names, and even children’s gaming usernames. These chains accelerate doxxing by allowing malicious actors to publish addresses, family relationships, and other sensitive context in one place. Credential leaks like this one are particularly dangerous because they often expose passwords or hints that unlock further systems, turning a corporate incident into a personal privacy crisis for you and your family.

Qilin Ransomware Group’s Track Record

Public reporting attributes the attack to the qilin ransomware group. The group emerged in 2022 and has since targeted organizations across multiple countries with a double-extortion playbook: first encrypting victim systems, then exfiltrating data and threatening to publish it unless a ransom is paid. Notable prior victims include healthcare providers, manufacturers, and service companies. Their typical approach involves initial access through phishing or exploited vulnerabilities, followed by rapid data exfiltration and publication on their leak site if demands are not met. The group operates under the name Qilin (sometimes styled as Qilin or Kylin in reporting) and maintains an active presence on dark-web leak portals that security researchers continue to track.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Tepas breach.
• Rotate any password you used at Tepas or its subsidiaries anywhere it has been reused, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and your children’s gaming accounts, which often become targets when corporate credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The Tepas incident is a reminder that ransomware groups move quickly and that data stolen from any company can surface in your life with little warning. Taking concrete steps now limits the damage and reduces the chance that this claimed breach becomes the first link in a larger chain of identity abuse. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain visibility and expert support before attackers turn stolen files into personal threats.