Ransomware: qilin claims Schreiner Trockenbau GmbH (AT) — Manufacturing

On August 1, 2026, the ransomware group Qilin publicly claimed responsibility for a cyberattack against Schreiner Trockenbau GmbH, an Austrian construction and drywall manufacturing firm. The claim was published on the ransomware live data-leak site, indicating that the group has exfiltrated data and is likely threatening to release it unless a ransom is paid. This is a breach notification event under the BREACH framework, meaning the incident is now public and carries regulatory implications under the EU’s NIS2 Directive and GDPR.

The primary affected organization is Schreiner Trockenbau GmbH, but the broader impact extends to its business partners, suppliers, and clients in the construction and manufacturing sectors across Austria and the EU. Any third-party vendors handling personal or operational data for this firm may also face downstream exposure. Qilin is a known ransomware-as-a-service operator, so this attack signals a continued threat to mid-sized industrial companies, which often have weaker security postures than large enterprises.

Compliance teams should immediately verify whether their organization has any data-sharing or contractual relationship with Schreiner Trockenbau. If so, assess the scope of any personal data involved and determine if a GDPR breach notification to the relevant supervisory authority is required within 72 hours. Additionally, review your own incident response and business continuity plans, specifically for ransomware scenarios, and confirm that backups are isolated and tested. Finally, monitor the ransomware live site and official advisories for any leaked data that may affect your systems, and update your vendor risk register to reflect this incident.