[ Ransomware claim · qilin · 23 Oct 2026 ]
Kale Balata A
The ransomware group qilin named Kale Balata A (Türkiye) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from Kale Balata A and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is Kale Balata A?
- What it does
- Kale Balata Otomotiv San. ve Tic. A.S. is a Turkish manufacturer of brake pads, brake linings and brake discs. Its products cover passenger cars, light commercial vehicles, heavy trucks, motorcycles and rail systems, and it also makes sintered pads for defence uses. It sells under its own brand and produces private-label products.
- Based in
- Gebze, Kocaeli, Türkiye
- Founded
- 1976
- Size
- a 16,000 square metre production facility in Gebze
- Who it serves
- Vehicle makers, the automotive aftermarket, rail and defence customers in Türkiye and in export markets, which it began expanding in 2015.
Partners and customers it names publicly
- Textar, 1993 licensing agreement for drum brake lining production
[ Impact ]Who could be affected
Vehicle makers, distributors and workshops that rely on its brake parts could see delayed orders or shipments if production or logistics systems were disrupted. Business customers and suppliers could face a higher risk of invoice fraud or phishing if any commercial information was exposed.
In agriculture and food production generally: Food supply and deliveries to shops and restaurants can be disrupted, and farmers and suppliers can be affected through shared ordering systems.
[ The attacker ]About qilin
Qilin, also known as Agenda, is a ransomware-as-a-service operation whose affiliates often gain access through vulnerable VPN and firewall devices or stolen credentials, steal data and then encrypt systems. It uses double extortion, threatening to publish data on its leak site, and has been among the most active groups in 2025 and 2026.
qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations qilin has named
- United States
- Chile
- Malaysia
- Germany
[ What to do ]If you are a customer, partner or neighbour
- Customers and distributors should confirm open orders and delivery dates with their usual Kale Balata contact.
- Verify any request to change bank details or payment instructions by phone using a known number.
- Be cautious with unexpected emails carrying invoices, price lists or attachments that appear to come from the company.
- Suppliers and partners with access to shared portals should reset their passwords and watch for unusual activity.