Who attacked Merko Ehitus?

qilin, a ransomware group, claimed the attack on Merko Ehitus on December 15, 2025. This cyberattack was formally announced and is tracked with 0 community validation(s).

What is the status of the attack on Merko Ehitus?

Current status: Announced. Data is not yet public. The attack was discovered on December 15, 2025 and 0 validation(s) have been recorded by the community.

In which country is Merko Ehitus located?

Merko Ehitus is an organization based in EE operating in the Construction sector.

What is the timeline of the attack on Merko Ehitus?

The attack follows a documented timeline of 3 events. First event: Découverte initiale (December 15, 2025). Latest event: Enrichissement AI (December 15, 2025). Each stage is tracked and validated by the DataInTheDark community.

Back to the threats

🏢

Merko Ehitus

🌐https://group.merko.ee🏭Construction🌍EE

📞

Phone

+3726501250

✉️

E-mail

[email protected]

📍

Address

Järvevana tee 9G, 11314 Tallinn, Estonia

💰

Revenue

€700M

👥

Employees

3000+

About

Major Baltic construction group handling sensitive infrastructure projects, employee data, financial records, and client information across multiple countries.

🎭

Ransomware group

qilin