cyfenced.com →

[ Ransomware claim · qilin · 25 Oct 2026 ]

ETO

The ransomware group qilin named ETO (Germany) on its leak site on 25 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Not confirmed so far

[ Status ]Has the attack been confirmed?

We have found no statement from ETO and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.

[ The organisation ]Who is ETO?

What it does
ETO GRUPPE develops and manufactures electromagnetic drive components, valves, sensors, electronics and control software for highly dynamic processes in vehicles and industrial plants. Its products are used in passenger cars, commercial vehicles and industrial applications such as hydraulics, rail technology, large diesel engines, energy technology and automation, and it also supplies components for hydrogen systems.
Based in
Stockach, Baden-Württemberg, Germany
Founded
1948, in Oberuhldingen, as Elektroteile GmbH Oberuhldingen
Size
about 2,000 employees worldwide, with sites in Germany, Poland, the USA, China, India and Mexico
Who it serves
ETO supplies manufacturers in the automotive, commercial vehicle and industrial sectors around the world. Its website shows companies such as Bosch, Knorr-Bremse, Danfoss, Parker and MTU as references.

Partners and customers it names publicly

  • Bosch, Shown as a reference customer on ETO's website
  • Knorr-Bremse, Shown as a reference customer on ETO's website
  • Danfoss, Shown as a reference customer on ETO's website
  • Parker, Shown as a reference customer on ETO's website
  • MTU, Shown as a reference customer on ETO's website

[ Impact ]Who could be affected

As a supplier of actuators, valves and sensors to vehicle and machinery makers, any disruption at ETO could delay deliveries of components and affect production planning at its customers. Business partners, suppliers and staff at its German and international sites could be affected if business or personal data were exposed.

In this kind of organisation generally: Customers, employees and partners can be affected: services can be interrupted, and personal or business data the organisation holds can be threatened with publication.

[ The attacker ]About qilin

Qilin, also known as Agenda, is a ransomware-as-a-service operation active since 2022 whose affiliates use double extortion, stealing data before encrypting systems, and can attack Windows, Linux and VMware ESXi. It was among the most active ransomware groups in the first half of 2026.

qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.

qilin on Ransomware.live

Other organisations qilin has named

[ What to do ]If you are a customer, partner or neighbour

  1. Customers should confirm any change to ETO's bank details, delivery terms or contact persons by phone using a number already on file.
  2. Treat unexpected emails that appear to come from ETO, especially those with attachments or payment requests, with extra caution.
  3. Purchasing and engineering teams should check whether shared drawings, specifications or access accounts need to be reviewed or reset.
  4. Follow official statements from ETO GRUPPE for confirmed information about any incident.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.