On October 18, 2024, defense and aerospace consulting firm SM&A, operating as www.smawins.com, appeared on the leak site of the qilin ransomware group. The listing states that all of the company’s internal files exfiltrated during a ransomware attack will become available for public download on 13 January 2025. The number of affected individuals remains unknown, and the precise data types contained in the files have not been detailed by the threat actors.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch smawins.com
Get alerted the next time smawins.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about smawins.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The qilin leak site entry, accessible via the onion link hosted on ransomware.live, states that SM&A suffered a ransomware intrusion in which internal files were successfully exfiltrated. It explicitly warns that the full dataset will be released for download on 13 January 2025 unless the company meets the actors’ undisclosed demands. The disclosure does not quantify the volume of records, list specific data fields, or name any individual victims. Public details about the company note that SM&A was founded in 1982 as Steven Myers & Associates and maintains its headquarters in Irvine, California.
Why This Matters for You and Your Family
Even though SM&A is a specialized defense contractor, its client and employee data frequently include personal information belonging to ordinary people. Contracts, resumes, background-check packages, payroll records, and vendor files often contain full names, Social Security numbers, dates of birth, addresses, and contact details for employees, subcontractors, and their dependents. If any of these records are in the exfiltrated archive, your information or that of a family member could surface on criminal forums within weeks. Once published, the data does not disappear; it spreads through automated scraping tools and is reused in future fraud campaigns for years.
Doxxing and Identity-Chain Risks
Ransomware operators like qilin rarely stop at posting a single compressed archive. They or subsequent buyers map exposed email addresses and usernames to personal social-media profiles, gaming accounts, and family-member records. A single leaked work email can link to your home address, phone number, and children’s usernames. These identity chains enable doxxing, SIM-swapping, and account takeovers that cross from professional data into personal life. Because the full dataset will not be released until mid-January 2025, there is still a narrow window to map and disrupt these linkages before the information reaches broader criminal ecosystems.