Microf LLC Hit by Qilin Ransomware Attack, Exposing Sensitive Consumer Data Microf LLC, a financial services firm specializing in lease-to-own solutions for HVAC and water heater systems, disclosed a significant data breach on December 23, 2025, following a ransomware attack by the Qilin cybercriminal group. The incident, first publicized through filings with the Massachusetts and New Hampshire attorney general offices, exposed sensitive personal information, including names and Social Security numbers of affected consumers. The breach originated on July 9, 2025, when Qilin claimed responsibility on its dark web portal, posting screenshots as proof of the compromise. The attack impacted 24 individuals in Massachusetts and seven in New Hampshire, though the full scope of affected consumers remains unclear. In response, Microf began notifying impacted individuals via letter, offering 24 months of complimentary credit monitoring and identity theft protection through Cyberscout (a TransUnion company). Affected consumers have 90 days from notification to enroll. The company also provided guidance on placing fraud alerts or credit freezes and accessing free annual credit reports from major bureaus. A dedicated call center was established to assist those affected. While no evidence of identity theft or fraud has been reported as of the disclosure, the breach’s severity is underscored by the exposure of Social Security numbers and the public dissemination of stolen data samples on the dark web. The incident highlights the ongoing threat posed by sophisticated ransomware groups targeting financial services firms.