Microf, LLC Data Breach and Ransomware Attack

**Microf LLC Hit by Qilin Ransomware Attack, Exposing Sensitive Consumer Data** Microf LLC, a financial services firm specializing in lease-to-own solutions for HVAC and water heater systems, disclosed a significant data breach on **December 23, 2025**, following a ransomware attack by the **Qilin cybercriminal group**. The incident, first publicized through filings with the **Massachusetts and New Hampshire attorney general offices**, exposed sensitive personal information, including **names and Social Security numbers** of affected consumers. The breach originated on **July 9, 2025**, when Qilin claimed responsibility on its dark web portal, posting screenshots as proof of the compromise. The attack impacted **24 individuals in Massachusetts and seven in New Hampshire**, though the full scope of affected consumers remains unclear. In response, Microf began notifying impacted individuals via letter, offering **24 months of complimentary credit monitoring and identity theft protection** through **Cyberscout (a TransUnion company)**. Affected consumers have **90 days** from notification to enroll. The company also provided guidance on placing **fraud alerts or credit freezes** and accessing free annual credit reports from major bureaus. A dedicated call center was established to assist those affected. While no evidence of identity theft or fraud has been reported as of the disclosure, the breach’s severity is underscored by the exposure of **Social Security numbers** and the public dissemination of stolen data samples on the dark web. The incident highlights the ongoing threat posed by sophisticated ransomware groups targeting financial services firms.