cyfenced.com →

[ Ransomware claim · qilin · 23 Oct 2026 ]

von Schaewen

The ransomware group qilin named von Schaewen (Germany) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Not confirmed so farOther

[ Status ]Has the attack been confirmed?

We have found no statement from von Schaewen and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.

[ The organisation ]Who is von Schaewen?

What it does
von Schaewen GmbH is a family-owned German steel processing company, now in its third generation, that forges, flame-cuts, welds, machines and trades steel. It makes custom flame-cut parts, open-die forgings, large welded steel structures and machined heavy parts, from single pieces to series production.
Based in
Essen, North Rhine-Westphalia, Germany
Founded
1931
Size
production sites in Essen, Wetter (Ruhr), Hückeswagen and Świętochłowice in Poland
Who it serves
It supplies heavy steel parts to industrial customers such as plant builders, the cement industry, shipbuilding and large infrastructure and research projects, with international sales supported by local representative offices.

Partners and customers it names publicly

  • SMS group, Customer project for rolling mill housings named on von Schaewen's website
  • FAIR Darmstadt (CBM experiment), Supplied a magnet yoke of about 153 tonnes of steel, per a company news item

[ Impact ]Who could be affected

Industrial customers waiting for forgings, flame-cut parts or welded structures could face delays in orders and deliveries if production or planning systems were disrupted. Customers, suppliers and employees could be affected if business documents or personal data were exposed.

In other generally: Customers, employees and partners can be affected: services can be interrupted, and personal or business data the organisation holds can be threatened with publication.

[ The attacker ]About qilin

Qilin, also known as Agenda, is a ransomware-as-a-service operation active since 2022 whose affiliates use double extortion, stealing data before encrypting systems, and can attack Windows, Linux and VMware ESXi. It was among the most active ransomware groups in the first half of 2026.

qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.

qilin on Ransomware.live

Other organisations qilin has named

[ What to do ]If you are a customer, partner or neighbour

  1. Customers should confirm any change in bank details, invoices or delivery terms by phone with a known contact at von Schaewen.
  2. Be cautious of unexpected emails that appear to come from the company, particularly those with attachments or links.
  3. Check whether drawings or technical specifications shared with the company are commercially sensitive and plan accordingly.
  4. Follow official statements from von Schaewen for confirmed information.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.

[ Similar claims ]Other other organisations in Germany