On July 22, 2026, the Qilin ransomware group publicly claimed an attack on P & A Construction, a U.S. civil engineering firm, threatening to leak stolen data unless the company negotiates. Qilin isn't a story about a single victim — it's the most active ransomware crew of 2026, and construction, manufacturing, and professional services firms in the small-to-midsize range are exactly the profile they hunt. If you run a York County business in one of those sectors, this attack is a preview of your threat model this quarter.
What happened
On July 22, 2026, the notorious ransomware group Qilin announced a cyberattack against P & A Construction, a U.S. civil engineering construction firm, and warned that sensitive data will be exposed if the company fails to engage in negotiations. That's the standard Qilin playbook: encrypt the victim's files, steal a copy first, then post the company on a dark-web leak site with a countdown timer to force payment.
The reason this matters beyond one construction company: Qilin is now the dominant ransomware operator on the internet. By October 2025, Qilin was responsible for 29% of all ransomware attacks globally, and in the first two weeks of January 2026 the group posted over 55 new victims to its leak site, putting it ahead of its already record-setting 2025 pace. With over 500 victim organizations posted in 2026 alone, Qilin's targeting spans industries and organization sizes that make it relevant to both mature security programs and resource-constrained teams.
Why small businesses are the target, not the exception
There is a persistent myth that ransomware crews only chase Fortune 500 payouts. Qilin has spent two years proving the opposite. There's a common assumption that ransomware groups go after big corporations with deep pockets, but Qilin doesn't operate that way — their 2025 victim list is full of small and mid-sized organizations, from local courts and school districts to healthcare practices and water utilities.
The sector mix should get every York County owner's attention. Manufacturing and Production is the most targeted sector, followed by Professional Services, Retail and Hospitality, Technology, and Construction and Engineering. That's a near-perfect overlap with the backbone of the South Central PA economy.
Worse, Qilin has specifically hunted the IT companies that small businesses trust. Rather than attacking businesses one at a time, Qilin has repeatedly gone after managed service providers (MSPs), the outsourced IT companies that many small businesses rely on to manage their networks, security, and day-to-day technology. If your IT provider gets popped, you get popped.
How Qilin actually gets in
Qilin affiliates aren't using magic. They're using the same doors most SMBs leave unlocked. The group has been observed stealing Google Chrome credentials before triggering encryption, abusing Windows Subsystem for Linux (WSL) to evade endpoint detection, and harvesting VPN credentials to establish persistent footholds inside corporate networks.
Once inside, they turn the screws. Qilin affiliates have also been observed applying additional pressure tactics during negotiations, including threatening to notify the victim's regulators directly of the breach, contacting individual executives named in the stolen data, and, in some cases, reaching out to the victim's clients or business partners to amplify reputational damage. That's the part that hurts a small business the most — even if you have clean backups, the stolen data is already gone.
What your managed IT provider should be doing about this — this week
This is not a wait-and-see incident. If you outsource your IT, or you have an internal person who could use backup, here is the checklist your provider should already be executing against as part of a proper managed IT and cybersecurity program:
- **Enforce phishing-resistant MFA on every account** — especially VPN, Microsoft 365, and any remote-access tool. Stolen passwords are Qilin's front door. - **Audit VPN and remote-access appliances.** Patch them immediately. Disable local accounts. Require MFA on the gateway itself, not just the apps behind it. - **Kill browser-saved passwords on company devices** and move users to a business password manager. Qilin actively harvests Chrome credentials. - **Confirm EDR is deployed on every endpoint and server** — not antivirus, EDR — and that alerts are being watched 24/7, not just during business hours. - **Test your backups by actually restoring something.** Immutable, offline copies. If your backup lives on the same network as your production systems, it will be encrypted alongside them. - **Ask your provider how they secure their own tools.** MSPs are a Qilin target. If your IT company can't answer that clearly, that's your answer. Businesses that already have an internal IT lead and just need defensive depth should look at a co-managed arrangement that adds 24/7 monitoring and after-hours coverage without replacing the person you already trust.
What York Businesses Should Do
York County construction firms, manufacturers, and professional services shops sit squarely inside Qilin's preferred victim profile — and Central PA has already seen ransomware reach the state Attorney General's office and multiple county governments. If you haven't had a candid conversation with your IT provider about MFA, VPN patching, EDR coverage, and offline backups in the last 90 days, that conversation needs to happen this week.