Unverified claim: Ransomware group Qilin listed Inova Semiconductors GmbH (inova-semiconductors.de) — the Munich-area maker of automotive connectivity chips (APIX, ISELED) — on its leak site around October 2, 2026, per Ransomware.live and threat-intel alerts. At indexing, BreachHistory found no company confirmation, regulator filing, or attested employee/customer census. (Searchers typing “Invoa” usually mean this Inova GmbH.)
Canonical: https://breachhistory.com/inova-semiconductors/inova-semiconductors-qilin2026.
Who Inova is
Founded 1999, Inova specializes in gigabit serial links for automotive infotainment and lighting networks. An ISO9001 supplier with IATF-facing manufacturing partners, it sits in the European auto electronics chain — attractive to ransomware crews hunting design docs and IT estates, not just consumer PII dumps.
What the listing does and does not prove
Trackers show victim name, DE country, domain, and discovery timestamp. Description fields were empty (“N/A”) in the RL snapshot — no public GB size or file samples in the index used here. Until Inova issues a statement, treat downtime rumors and alleged IP theft as unconfirmed.
Why we catalog it
Named ransomware/extortion leak-site claims against identifiable orgs are cataloged from June 2026 onward when clearly labeled unverified. A German automotive semiconductor vendor clears that bar; spelling variants (“Invoa”) should redirect readers here.
Action items
- Partners: verify any “Inova breach invoice” emails out-of-band.
- Employees: watch spear-phishing referencing chip programs.
- Press: wait for company/regulator confirmation before writing impact as fact.
Sources
Open questions and verification posture
Week-one reporting rarely includes full malware forensics. Separate victim/regulator facts from actor marketing. Missing headcounts stay zero in the catalog until a filing appears. That discipline keeps BreachHistory usable when headlines inflate.
Phishing to expect
Lookalike domains, fake incident-response WhatsApp accounts, and urgency around fake enrollment deadlines. Call numbers printed on official letters only. Do not install remote-support tools from cold callers. Do not pay crypto to strangers.
Neighboring incidents
Cross-read related BreachHistory finance, education, healthcare, and ransomware-claim posts for pattern recognition — shared vendor risk and delayed consumer mailings recur through 2026. Use comparisons for briefings, not to copy unverified counts across rows.
Security-team checklist
- Inventory non-core systems holding identifiers.
- Phishing-resistant MFA on those systems.
- Log/alert bulk exports.
- Pre-draft counsel-approved notices.
- Tabletop a 72-hour extortion email with legal and PR.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.