qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sem Val de Bourgogne | December 10, 2025 | ransomware_live | — |
| CIDEF Argentina S.A. | December 10, 2025 | ransomware_live | — |
| Lonich Patton Ehrlich Policastri | December 10, 2025 | ransomware_live | — |
| GROUPE ETMB | December 10, 2025 | ransomware_live | — |
| Serratelli Hat | December 9, 2025 | ransomware_live | — |
| Leandri & Associes | December 9, 2025 | ransomware_live | — |
| TopDest | December 9, 2025 | ransomware_live | — |
| West Quay | December 9, 2025 | ransomware_live | — |
| Hexacon Construction | December 9, 2025 | ransomware_live | — |
| Tupi | December 9, 2025 | ransomware_live | — |
| Teruya Brothers Ltd | December 9, 2025 | ransomware_live | — |
| Canno Design | December 8, 2025 | ransomware_live | — |
| Redi Carpet | December 8, 2025 | ransomware_live | — |
| Poyntell Limited | December 8, 2025 | ransomware_live | — |
| Seipi | December 8, 2025 | ransomware_live | — |
| Cagayan Appliance Center | December 8, 2025 | ransomware_live | — |
| Elite Flower | December 8, 2025 | ransomware_live | — |
| Sanko Air Conditioning Co., Ltd. | December 7, 2025 | ransomware_live | — |
| Marta Montserrat Areny Guerrero ABOGADO | December 7, 2025 | ransomware_live | — |
| AMH Philippines | December 7, 2025 | ransomware_live | — |
| Acoustical Control | December 7, 2025 | ransomware_live | — |
| La Costa Dental Excellence | December 7, 2025 | ransomware_live | — |
| David M. Schwarz Architects | December 7, 2025 | ransomware_live | — |
| UniqueTech Engineering | December 6, 2025 | ransomware_live | — |
| Canvas Church | December 6, 2025 | ransomware_live | — |
| Diesel Electric | December 6, 2025 | ransomware_live | — |
| Kasapreko | December 6, 2025 | ransomware_live | — |
| Khazzan Logistics | December 6, 2025 | ransomware_live | — |
| Towerstream | December 6, 2025 | ransomware_live | — |
| BUCKSWOOD | December 5, 2025 | ransomware_live | — |
| Shumate Mechanical | December 5, 2025 | ransomware_live | — |
| Beecher Walker Architects | December 5, 2025 | ransomware_live | — |
| Mainz University of Applied Sciences | December 4, 2025 | ransomware_live | — |
| Tensator | December 4, 2025 | ransomware_live | — |
| Northwest Iowa Community College | December 4, 2025 | ransomware_live | — |
| PureLogic IT Solutions | December 4, 2025 | ransomware_live | — |
| Cap Cana | December 4, 2025 | ransomware_live | — |
| Sonora Independent School District | December 4, 2025 | ransomware_live | — |
| Bigben Group | December 4, 2025 | ransomware_live | — |
| Yellow Cab of Columbus | December 4, 2025 | ransomware_live | — |
| Peter Meijer Architect | December 4, 2025 | ransomware_live | — |
| Institutional & Supermarket Equipment | December 4, 2025 | ransomware_live | — |
| McManes Law | December 4, 2025 | ransomware_live | — |
| Espaço Casa | December 4, 2025 | ransomware_live | — |
| Scientology | December 4, 2025 | ransomware_live | — |
| Medisend | December 4, 2025 | ransomware_live | — |
| Kana Pipeline Inc | December 4, 2025 | ransomware_live | — |
| NUMALLIANCE | December 3, 2025 | ransomware_live | — |
| City of Urbana | December 3, 2025 | ransomware_live | — |
| Brodosplit | December 3, 2025 | ransomware_live | — |
| LA Injury Attorneys | December 3, 2025 | ransomware_live | — |
| CST Coal | December 3, 2025 | ransomware_live | — |
| Mainetti UK | December 3, 2025 | ransomware_live | — |
| Tlusty & Kennedy | December 2, 2025 | ransomware_live | — |
| Mr Christmas | December 2, 2025 | ransomware_live | — |
| Oriental Castle Sdn Bhd | December 2, 2025 | ransomware_live | — |
| Saca Industrie SpA | December 2, 2025 | ransomware_live | — |
| EDIS | December 2, 2025 | ransomware_live | — |
| GreenBest | December 2, 2025 | ransomware_live | — |
| VENZI & PAGANINI AG | December 2, 2025 | ransomware_live | — |
| Moyes | December 2, 2025 | ransomware_live | — |
| Virtualware Solutions | December 1, 2025 | ransomware_live | — |
| HASCO Hasenclever | December 1, 2025 | ransomware_live | — |
| B dynamic | December 1, 2025 | ransomware_live | — |
| France terre d'asile | December 1, 2025 | ransomware_live | — |
| San Miguel | December 1, 2025 | ransomware_live | — |
| GOOD+ Foundation | December 1, 2025 | ransomware_live | — |
| Battaglioli | November 30, 2025 | ransomware_live | — |
| ILCA Targhe s.r.l. | November 30, 2025 | ransomware_live | — |
| Veton Ai | November 30, 2025 | ransomware_live | — |
| Chenango Valley Technologies | November 29, 2025 | ransomware_live | — |
| CJW | November 29, 2025 | ransomware_live | — |
| TBC Consoles | November 29, 2025 | ransomware_live | — |
| Bomchil | November 29, 2025 | ransomware_live | — |
| Asia Condominium Association | November 29, 2025 | ransomware_live | — |
| Aceros Ocotlán Group | November 28, 2025 | ransomware_live | — |
| Reynolds Logistics | November 28, 2025 | ransomware_live | — |
| Williamson County, TX | November 28, 2025 | ransomware_live | — |
| Weiss | November 28, 2025 | ransomware_live | — |
| Zoya | November 28, 2025 | ransomware_live | — |
| WLR Precision Engineering | November 27, 2025 | ransomware_live | — |
| Santa Paula | November 27, 2025 | ransomware_live | — |
| United Volleyball Supply | November 27, 2025 | ransomware_live | — |
| Bcfpers | November 27, 2025 | ransomware_live | — |
| ERR Raumplaner | November 27, 2025 | ransomware_live | — |
| Comansco | November 27, 2025 | ransomware_live | — |
| Workflow Concepts | November 26, 2025 | ransomware_live | — |
| Eastek International | November 26, 2025 | ransomware_live | — |
| Burnham Brown | November 26, 2025 | ransomware_live | — |
| Disston | November 26, 2025 | ransomware_live | — |
| Trolec | November 26, 2025 | ransomware_live | — |
| Arabia Holding | November 26, 2025 | ransomware_live | — |
| The American School Foundation | November 26, 2025 | ransomware_live | — |
| Manassas City Public Schools | November 25, 2025 | ransomware_live | — |
| Animart Pet Stores | November 25, 2025 | ransomware_live | — |
| Blue Projects | November 25, 2025 | ransomware_live | — |
| Zecher | November 25, 2025 | ransomware_live | — |
| Nottingham Village | November 25, 2025 | ransomware_live | — |
| Columbia Medical Practice | November 25, 2025 | ransomware_live | — |
| Christofle | November 25, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).