[ Ransomware claim · qilin · 25 Oct 2026 ]
ECOM
The ransomware group qilin named ECOM (Switzerland) on its leak site on 25 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
No public statement from ECOM or press report of a cyber incident in 2026 was found at the time of writing.
[ The organisation ]Who is ECOM?
- What it does
- ECOM Agroindustrial is a commodity merchant and processor that sources coffee, cocoa, cotton, and nuts and ingredients directly from farmers. It also provides primary processing, logistics and risk management services, and supplies branded product manufacturers worldwide. Wikipedia describes it as one of the world's largest coffee millers.
- Based in
- Pully, Switzerland
- Founded
- 1849, as a cotton trading business in Spain
- Size
- more than 6,000 employees worldwide, including over 1,000 agronomists and field staff, with operations in more than 40 countries
- Who it serves
- ECOM supplies coffee, cocoa, cotton and other ingredients to branded product manufacturers and says it serves customers across six continents. It buys from thousands of farmers and local businesses in producing countries.
Partners and customers it names publicly
- Colcafé, partner in a coffee programme in Santander, Colombia, named on ECOM's website
- Nutresa, partner in a coffee programme in Santander, Colombia, named on ECOM's website
- Rainforest Alliance, certification scheme under which ECOM managed a group certificate for some Brazilian farms
[ Impact ]Who could be affected
An attack on a large commodity trader could delay purchasing, processing or shipments of coffee, cocoa and cotton, which could be felt by food and textile manufacturers further down the supply chain. Farmers and suppliers who sell to ECOM could see payments or contract paperwork held up. Information about employees, suppliers and customers could be at risk if the claim is accurate.
In retail & e-commerce generally: Shoppers can face order delays and phishing that uses their order history, and online shops hold names, addresses and sometimes payment data.
[ The attacker ]About qilin
Qilin, formerly known as Agenda, is a ransomware-as-a-service operation that recruits affiliates and practises double extortion, stealing data and threatening to publish it as well as encrypting systems. US health authorities report that its affiliates commonly gain access through spear phishing and the abuse of remote monitoring and management tools.
qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations qilin has named
- United States
- Chile
- Malaysia
- Germany
[ What to do ]If you are a customer, partner or neighbour
- If you supply or buy from ECOM, confirm any request to change bank details or payment instructions through a contact you already know before acting on it.
- Be cautious with emails about shipments, contracts or invoices that appear to come from ECOM, and check attachments and links before opening them.
- Watch for official updates from ECOM about any effect on deliveries or contracts and plan for possible delays.
- If you share systems or portal access with ECOM, review those accounts and change passwords used for them.
[ Similar claims ]Other retail & e-commerce organisations in Switzerland
- medusalocker
- payload