[ Ransomware claim · qilin · 23 Oct 2026 ]
Aerotop
The ransomware group qilin named Aerotop (Chile) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from Aerotop and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is Aerotop?
- What it does
- Aerotop is a Chilean geospatial services company that carries out aerial and drone LiDAR and photogrammetry surveys, geodesy and topography, bathymetry and infrastructure inspection. It also offers fixed LiDAR monitoring for mine stockpiles and slopes, using drones, survey aircraft and uncrewed survey boats.
- Based in
- Providencia, Santiago, Chile
- Founded
- more than 60 years ago, according to its website
- Size
- more than 2,500 projects in Chile, Argentina and Peru, according to its website
- Who it serves
- It serves mining companies, engineering and construction firms, utilities and transport operators that need survey, mapping and inspection data, with work across Chile, Argentina and Peru.
Partners and customers it names publicly
- Codelco, client listed on Aerotop's website
- Anglo American, client listed on Aerotop's website
- Antofagasta Minerals, client listed on Aerotop's website
- Acciona, client listed on Aerotop's website
- Teck, client listed on Aerotop's website
[ Impact ]Who could be affected
If the claim were accurate, survey and monitoring work for mining, energy and infrastructure clients could be delayed, and project data such as maps, surveys and site information could be exposed. Clients and their contractors could be targeted with follow-up phishing. The listing is a claim by criminals and has not been confirmed.
In transportation generally: Shipments, deliveries and travel can be held up for the businesses and people who rely on them, and logistics firms hold data about their customers' cargo and routes.
[ The attacker ]About qilin
Qilin, also known as Agenda, is a ransomware-as-a-service operation whose affiliates steal data before encrypting systems and threaten to publish it. Security researchers report that intrusions often start with stolen valid credentials for remote access systems, and that it also targets Linux and VMware ESXi servers.
qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations qilin has named
- United States
- Chile
- Malaysia
- Germany
[ What to do ]If you are a customer, partner or neighbour
- Clients should ask their Aerotop contact whether any project data they shared could be involved and review what site or survey information was exchanged.
- Treat emails that appear to come from Aerotop with attachments, links or payment requests with caution and confirm them by phone.
- Review and remove any shared folders, portals or remote access set up for Aerotop that are no longer needed.
- Watch for an official statement from the company before acting on claims seen online.