qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| New England Tractor Trailer Training School | November 25, 2025 | ransomware_live | — |
| Inspire Communities | November 25, 2025 | ransomware_live | — |
| Paal | November 25, 2025 | ransomware_live | — |
| Lake Superior State University | November 25, 2025 | ransomware_live | — |
| AWIN Group of Dealerships | November 24, 2025 | ransomware_live | — |
| NovAtel (belongs to Hexagon) | November 24, 2025 | ransomware_live | — |
| HYTORC | November 24, 2025 | ransomware_live | — |
| Nissan Capital | November 23, 2025 | ransomware_live | — |
| Capp Shupak | November 23, 2025 | ransomware_live | — |
| Berts Electric | November 23, 2025 | ransomware_live | — |
| The Hunnicutt Law Group | November 23, 2025 | ransomware_live | — |
| Cayuga Milk Ingredients | November 23, 2025 | ransomware_live | — |
| Cal-Comp Electronics Public | November 23, 2025 | ransomware_live | — |
| Maheu&Maheu | November 23, 2025 | ransomware_live | — |
| Interlink Trade Services | November 22, 2025 | ransomware_live | — |
| Kajima Europe | November 22, 2025 | ransomware_live | — |
| Mmlk | November 22, 2025 | ransomware_live | — |
| Hotaling Insurance Services | November 21, 2025 | ransomware_live | — |
| XOX Mobile | November 21, 2025 | ransomware_live | — |
| Alma Realty | November 21, 2025 | ransomware_live | — |
| N15 Technology | November 20, 2025 | ransomware_live | — |
| Mae Krathing Power Company | November 20, 2025 | ransomware_live | — |
| Sakol Energy Public | November 20, 2025 | ransomware_live | — |
| Cimertex | November 20, 2025 | ransomware_live | — |
| Fayette County | November 20, 2025 | ransomware_live | — |
| Marine Foods Express LTD | November 19, 2025 | ransomware_live | — |
| IGT | November 19, 2025 | ransomware_live | — |
| BioPharma Services | November 19, 2025 | ransomware_live | — |
| QuaLex Manufacturing | November 18, 2025 | ransomware_live | — |
| Kensington Court | November 18, 2025 | ransomware_live | — |
| Regional Business Systems | November 18, 2025 | ransomware_live | — |
| Spark Innovation | November 18, 2025 | ransomware_live | — |
| Kdr Real Estate Services | November 17, 2025 | ransomware_live | — |
| Maresa Logística | November 16, 2025 | ransomware_live | — |
| Spark Power | November 15, 2025 | ransomware_live | — |
| FREEDL GROUP s.r.l. | November 15, 2025 | ransomware_live | — |
| SES Société Energies Services | November 15, 2025 | ransomware_live | — |
| Trigg Laboratories | November 14, 2025 | ransomware_live | — |
| Sol Trading | November 14, 2025 | ransomware_live | — |
| Cornerstone Staffing Solutions | November 13, 2025 | ransomware_live | — |
| Muskoka Brewery | November 13, 2025 | ransomware_live | — |
| Fundidora de Cananea, S.A | November 13, 2025 | ransomware_live | — |
| Viabizzuno | November 13, 2025 | ransomware_live | — |
| Cinvestav | November 13, 2025 | ransomware_live | — |
| Brian-Kyles Construction | November 11, 2025 | ransomware_live | — |
| Mciver Engineering & Controls | November 10, 2025 | ransomware_live | — |
| OMS | November 10, 2025 | ransomware_live | — |
| Yaesu | November 10, 2025 | ransomware_live | — |
| Dublin Medical Center | November 9, 2025 | ransomware_live | — |
| Hitzinger | November 9, 2025 | ransomware_live | — |
| Gullco International | November 9, 2025 | ransomware_live | — |
| Scouts Canada | November 8, 2025 | ransomware_live | — |
| SHRM New Mexico | November 8, 2025 | ransomware_live | — |
| Advanced Delivery Services | November 8, 2025 | ransomware_live | — |
| Wasserverband Wulkatal | November 8, 2025 | ransomware_live | — |
| JC Auto Accident Law Firm | November 8, 2025 | ransomware_live | — |
| Gadge USA | November 8, 2025 | ransomware_live | — |
| Mecaplast | November 7, 2025 | ransomware_live | — |
| Rex-Hide | November 7, 2025 | ransomware_live | — |
| Klae Construction | November 7, 2025 | ransomware_live | — |
| Village of New Lenox | November 7, 2025 | ransomware_live | — |
| Marine Turbine Technologies | November 7, 2025 | ransomware_live | — |
| Shollenberger Januzzi & Wolfe | November 7, 2025 | ransomware_live | — |
| Atlantic City Housing Authority | November 6, 2025 | ransomware_live | — |
| southernpipe.com | November 6, 2025 | ransomware_live | — |
| Shadow Wood Community Association | November 6, 2025 | ransomware_live | — |
| Dataprobe | November 6, 2025 | ransomware_live | — |
| Ketel Thorstenson | November 6, 2025 | ransomware_live | — |
| Club Blue Form | November 6, 2025 | ransomware_live | — |
| Ida Crown Jewish Academy | November 6, 2025 | ransomware_live | — |
| Toledo School for the Arts | November 6, 2025 | ransomware_live | — |
| Thalheimer Brothers | November 6, 2025 | ransomware_live | — |
| ATEK Access Technologies | November 6, 2025 | ransomware_live | — |
| BMG Of Kansas | November 6, 2025 | ransomware_live | — |
| Pims | November 6, 2025 | ransomware_live | — |
| Egyptian Workspace Partners | November 6, 2025 | ransomware_live | — |
| Noble Compaña de Seguros | November 6, 2025 | ransomware_live | — |
| Ville de MontLaurier | November 6, 2025 | ransomware_live | — |
| Tass Meister Patent Firm | November 6, 2025 | ransomware_live | — |
| UScraft | November 6, 2025 | ransomware_live | — |
| PCB Uitvaartzorg | November 6, 2025 | ransomware_live | — |
| Sai Mai Hospital | November 6, 2025 | ransomware_live | — |
| Systems Integrated | November 6, 2025 | ransomware_live | — |
| Studio Corvo Parma | November 6, 2025 | ransomware_live | — |
| Maset | November 6, 2025 | ransomware_live | — |
| Durvet | November 5, 2025 | ransomware_live | — |
| Habib Bank | November 5, 2025 | ransomware_live | — |
| Habib Bank AG Zurich | November 5, 2025 | ransomware_live | — |
| Maine Course Hospitality Group | November 5, 2025 | ransomware_live | — |
| Francehopital | November 5, 2025 | ransomware_live | — |
| RBB Architects | November 4, 2025 | ransomware_live | — |
| Centro de Formación San Nicolás | November 4, 2025 | ransomware_live | — |
| Prova | November 4, 2025 | ransomware_live | — |
| Mango's Tropical Cafe | November 4, 2025 | ransomware_live | — |
| Jason Finch & Associates | November 3, 2025 | ransomware_live | — |
| ANCO | November 3, 2025 | ransomware_live | — |
| Deco Dental | November 2, 2025 | ransomware_live | — |
| Gun Accessory Supply | October 31, 2025 | ransomware_live | — |
| Magicline | October 30, 2025 | ransomware_live | — |
| bagnoles.nl | October 30, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).