CFM Mozambique listed by the Qilin ransomware group

Overview

The Qilin ransomware group has listed CFM (Caminhos de Ferro de Moçambique), the state-owned railway operator of Mozambique, on its leak site. The listing appeared on 16 January 2026. At the time of analysis, the group's leak page was not reachable.

What was published

The group has listed the operator as a victim but has not published detailed data descriptions at this stage. Railway operators hold operational records, corporate data and employee information, which are the likely contents of any exfiltration.

Risks for affected individuals

• Employees' personal records may be exposed.
• Operational data could reveal infrastructure details.
• Corporate information may be misused.

What remains unknown

• Whether data has been exfiltrated.
• The volume of records involved.
• The timeline of any release.

What affected people should do

The operator should coordinate with Mozambican cybersecurity authorities, review affected systems, and inform staff. Employees should be alert to phishing referencing the railway operator.