qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Hunter-Kelsey of Texas | February 10, 2026 | ransomware_live | — |
| Korsmo Construction | February 10, 2026 | ransomware_live | — |
| Anabuki Kosan | February 10, 2026 | ransomware_live | — |
| C4 (Carroll County Cannabis Co. | February 10, 2026 | ransomware_live | — |
| Gradient Wind Engineering | February 9, 2026 | ransomware_live | — |
| Body By Fisher | February 9, 2026 | ransomware_live | — |
| iQ NetSolutions | February 9, 2026 | ransomware_live | — |
| Augusta Housing Authority | February 9, 2026 | ransomware_live | — |
| uniquegas | February 9, 2026 | ransomware_live | — |
| Tech Environmental | February 9, 2026 | ransomware_live | — |
| Voyages Robin | February 8, 2026 | ransomware_live | — |
| AB Data | February 8, 2026 | ransomware_live | — |
| KV Final | February 7, 2026 | ransomware_live | — |
| AMR PEMCO | February 7, 2026 | ransomware_live | — |
| PARIS & MARSEILLE | February 7, 2026 | ransomware_live | — |
| voyages-robin.com | February 7, 2026 | ransomware_live | — |
| abdata.com | February 7, 2026 | ransomware_live | — |
| castlestechemea.com | February 7, 2026 | ransomware_live | — |
| poweron.com | February 7, 2026 | ransomware_live | — |
| zeroenergy.com | February 7, 2026 | ransomware_live | — |
| granmanor.org | February 7, 2026 | ransomware_live | — |
| La Fabrica | February 6, 2026 | ransomware_live | — |
| Parente Fireworks | February 6, 2026 | ransomware_live | — |
| PLUS Malaysia Berhad | February 6, 2026 | ransomware_live | — |
| Grand Manor Nursing & Rehabilitation Center | February 5, 2026 | ransomware_live | — |
| Florida Retina Center | February 5, 2026 | ransomware_live | — |
| Conpet S.A. (COTE.RO) | February 5, 2026 | ransomware_live | — |
| University of Applied Sciences,Worms | February 5, 2026 | ransomware_live | — |
| Cheltenham Orthodontics | February 4, 2026 | ransomware_live | — |
| RC Collecting | February 4, 2026 | ransomware_live | — |
| JOSE COMBALIA SA | February 4, 2026 | ransomware_live | — |
| ChainPower Technology | February 4, 2026 | ransomware_live | — |
| Chèvre & Rutsch & Herren Notariatsbüro | February 4, 2026 | ransomware_live | — |
| RENAFAN | February 4, 2026 | ransomware_live | — |
| MB Distribution | February 4, 2026 | ransomware_live | — |
| Kopas Cosmetics | February 4, 2026 | ransomware_live | — |
| Hovde Group | February 3, 2026 | ransomware_live | — |
| Kinsman | February 3, 2026 | ransomware_live | — |
| Dunn & Associates | February 3, 2026 | ransomware_live | — |
| Scranton Label | February 3, 2026 | ransomware_live | — |
| P&B Textiles | February 3, 2026 | ransomware_live | — |
| Utah Olympic Legacy Foundation | February 3, 2026 | ransomware_live | — |
| Mmca | February 3, 2026 | ransomware_live | — |
| The Rosenthal Agency | February 3, 2026 | ransomware_live | — |
| Medasa | February 3, 2026 | ransomware_live | — |
| Jingchang Enterprise Co., Ltd | February 3, 2026 | ransomware_live | — |
| Stephenson Ziegenhorn & Bernard | February 2, 2026 | ransomware_live | — |
| Sprokkit | February 2, 2026 | ransomware_live | — |
| INGUS | February 2, 2026 | ransomware_live | — |
| Jcm Agricola | February 2, 2026 | ransomware_live | — |
| Exterior Worlds | February 2, 2026 | ransomware_live | — |
| KOUEI | February 2, 2026 | ransomware_live | — |
| The Hechtman Group | February 2, 2026 | ransomware_live | — |
| Range Cooperatives | February 2, 2026 | ransomware_live | — |
| Workers Health & Safety Centre | February 2, 2026 | ransomware_live | — |
| Muebles Dico | February 2, 2026 | ransomware_live | — |
| Medinah School District 11 | February 2, 2026 | ransomware_live | — |
| SoCal ROC | February 1, 2026 | ransomware_live | — |
| Tulsa International Airport | January 30, 2026 | ransomware_live | — |
| Rich Sport Public | January 30, 2026 | ransomware_live | — |
| Littlefield Companies | January 30, 2026 | ransomware_live | — |
| Esperance Communications | January 30, 2026 | ransomware_live | — |
| Trace | January 30, 2026 | ransomware_live | — |
| Cooperativa de Hostelería de Navarra | January 30, 2026 | ransomware_live | — |
| MBC | January 30, 2026 | ransomware_live | — |
| Keil Erdbau | January 29, 2026 | ransomware_live | — |
| Moontown | January 29, 2026 | ransomware_live | — |
| Plan-IT Office Solutions | January 29, 2026 | ransomware_live | — |
| NessCampbell | January 28, 2026 | ransomware_live | — |
| Service Broadcasting Group | January 28, 2026 | ransomware_live | — |
| KRÜSS | January 28, 2026 | ransomware_live | — |
| Chu & Yang Dental | January 28, 2026 | ransomware_live | — |
| Valbifrut | January 28, 2026 | ransomware_live | — |
| InfoCom | January 28, 2026 | ransomware_live | — |
| Philippine Savings Bank (Metrobank Group) | January 28, 2026 | ransomware_live | — |
| Jay's Sporting Goods | January 27, 2026 | ransomware_live | — |
| Westin Automotive | January 27, 2026 | ransomware_live | — |
| Sukhothai Thammathirat Open University | January 27, 2026 | ransomware_live | — |
| Mills Products | January 26, 2026 | ransomware_live | — |
| Şemsioğlu Uşak Ev Tarhanası | January 25, 2026 | ransomware_live | — |
| OKIN GROUP | January 25, 2026 | ransomware_live | — |
| Centrotherm International | January 25, 2026 | ransomware_live | — |
| CYMOT | January 25, 2026 | ransomware_live | — |
| Milott Laboratories | January 24, 2026 | ransomware_live | — |
| D & D Building | January 24, 2026 | ransomware_live | — |
| Borg Argentina | January 24, 2026 | ransomware_live | — |
| HARTE-BAVENDAMM Rechtsanwlte PartG mbB | January 24, 2026 | ransomware_live | — |
| Herzing | January 24, 2026 | ransomware_live | — |
| Shiffler Equipment Sales | January 24, 2026 | ransomware_live | — |
| YCC Parts Mfg | January 23, 2026 | ransomware_live | — |
| County Contractors | January 22, 2026 | ransomware_live | — |
| Copetrol | January 22, 2026 | ransomware_live | — |
| Proleasing | January 22, 2026 | ransomware_live | — |
| Farmacias Vilela | January 22, 2026 | ransomware_live | — |
| SiNetCon | January 22, 2026 | ransomware_live | — |
| EDF Group | January 22, 2026 | ransomware_live | — |
| Centro de Desarrollo Emprendedor Ensenada | January 21, 2026 | ransomware_live | — |
| Mutest | January 21, 2026 | ransomware_live | — |
| Altius Geotecnia y Obras Especiales | January 20, 2026 | ransomware_live | — |
| Kontena Nasional Berhad | January 20, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).