qilin
First seen October 8, 2022Active2,651 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| dalton.com | October 16, 2025 | ransomware_live | — |
| montship.ca | October 16, 2025 | ransomware_live | — |
| pandarose.ca | October 16, 2025 | ransomware_live | — |
| halifax.k12.va.us | October 16, 2025 | ransomware_live | — |
| LEYHAUSEN Research | October 15, 2025 | ransomware_live | — |
| Commune De Saint Claude | October 15, 2025 | ransomware_live | — |
| Asahi Group Holdings | October 15, 2025 | ransomware_live | — |
| ville-elne | October 15, 2025 | ransomware_live | — |
| Wheale Law Firm | October 15, 2025 | ransomware_live | — |
| TF LE TOIT FOREZIEN | October 15, 2025 | ransomware_live | — |
| Florida Marking Products | October 15, 2025 | ransomware_live | — |
| Bay West | October 15, 2025 | ransomware_live | — |
| Victory Christian Center | October 15, 2025 | ransomware_live | — |
| Pangea | October 15, 2025 | ransomware_live | — |
| Buanderie Blanchelle | October 15, 2025 | ransomware_live | — |
| Superior Linen Service | October 15, 2025 | ransomware_live | — |
| Turnkey Africa | October 15, 2025 | ransomware_live | — |
| Centurion Family Office Services LLC | October 15, 2025 | ransomware_live | — |
| Richmond Behavioral Health Authority | October 15, 2025 | ransomware_live | — |
| Agencia Tributaria | October 15, 2025 | ransomware_live | — |
| Rasi Laboratories | October 15, 2025 | ransomware_live | — |
| Sprague & Jackson | October 15, 2025 | ransomware_live | — |
| Middlesex Appraisal Associates | October 15, 2025 | ransomware_live | — |
| Bengal Industries | October 15, 2025 | ransomware_live | — |
| M&E Global Group | October 14, 2025 | ransomware_live | — |
| DV Hardwoods | October 14, 2025 | ransomware_live | — |
| Force Marketing | October 14, 2025 | ransomware_live | — |
| Repeated Signal Solutions | October 14, 2025 | ransomware_live | — |
| Club Lleuresport | October 14, 2025 | ransomware_live | — |
| Tong Yang Group | October 14, 2025 | ransomware_live | — |
| Radiant Beauty Supplies | October 14, 2025 | ransomware_live | — |
| Clifford Paper | October 14, 2025 | ransomware_live | — |
| H. Gascon | October 14, 2025 | ransomware_live | — |
| Polar-studio | October 14, 2025 | ransomware_live | — |
| Capitol Construction Services | October 14, 2025 | ransomware_live | — |
| Morris-Sockle | October 14, 2025 | ransomware_live | — |
| HMP Global | October 14, 2025 | ransomware_live | — |
| Catawba County Government | October 14, 2025 | ransomware_live | — |
| American Journal of Managed Care | October 14, 2025 | ransomware_live | — |
| Typology | October 14, 2025 | ransomware_live | — |
| LaRosa's | October 14, 2025 | ransomware_live | — |
| Ditransa | October 14, 2025 | ransomware_live | — |
| Addis | October 14, 2025 | ransomware_live | — |
| Trans-World Shipping Service | October 14, 2025 | ransomware_live | — |
| Gittens Healthcare | October 14, 2025 | ransomware_live | — |
| City of Riviera Beach, Florida | October 14, 2025 | ransomware_live | — |
| Buldi | October 14, 2025 | ransomware_live | — |
| Paris Rétina Vision | October 14, 2025 | ransomware_live | — |
| UT Health Austin | October 14, 2025 | ransomware_live | — |
| PQCNC Hospitals | October 14, 2025 | ransomware_live | — |
| EURORDIS | October 14, 2025 | ransomware_live | — |
| SICE | October 14, 2025 | ransomware_live | — |
| Alqueria | October 14, 2025 | ransomware_live | — |
| Urban Linker | October 14, 2025 | ransomware_live | — |
| Hunter Construction Group | October 14, 2025 | ransomware_live | — |
| Roger RENARD Entreprise | October 14, 2025 | ransomware_live | — |
| Home/ Schramm Udo Dipl Kfm Steuerberater | October 14, 2025 | ransomware_live | — |
| Alu Perpignan | October 14, 2025 | ransomware_live | — |
| Executive Cabinetry | October 14, 2025 | ransomware_live | — |
| Prim Saveurs Import Export | October 14, 2025 | ransomware_live | — |
| Canapés Mobilier Décoration | October 14, 2025 | ransomware_live | — |
| Pro-Fab | October 14, 2025 | ransomware_live | — |
| Volkswagen Group France | October 14, 2025 | ransomware_live | — |
| WebCut Converting | October 14, 2025 | ransomware_live | — |
| SFG Technology Sdn Bhd | October 14, 2025 | ransomware_live | — |
| New Jersey Property-Liability Insurance Guaranty Association | October 14, 2025 | ransomware_live | — |
| Charles River Properties | October 14, 2025 | ransomware_live | — |
| Suarez & Menendez | October 14, 2025 | ransomware_live | — |
| Imperial Glazing Concepts | October 13, 2025 | ransomware_live | — |
| hautsdefrance.fr | October 13, 2025 | ransomware_live | — |
| SourceOne Corporation | October 13, 2025 | ransomware_live | — |
| BHI Co., Ltd. | October 13, 2025 | ransomware_live | — |
| San Bernard Electric Cooperative | October 13, 2025 | ransomware_live | — |
| Bank3 | October 13, 2025 | ransomware_live | — |
| Dynamic Precision Sverige | October 12, 2025 | ransomware_live | — |
| DuVal & Associates | October 11, 2025 | ransomware_live | — |
| Greenstar Social Marketing | October 11, 2025 | ransomware_live | — |
| Atarfil | October 11, 2025 | ransomware_live | — |
| grupocaparros.com | October 10, 2025 | ransomware_live | — |
| Artan Holding | October 10, 2025 | ransomware_live | — |
| Karnes Electric Cooperative | October 10, 2025 | ransomware_live | — |
| bmcinnovation.com | October 10, 2025 | ransomware_live | — |
| alissco.com | October 10, 2025 | ransomware_live | — |
| ePayData | October 9, 2025 | ransomware_live | — |
| MBS Secure | October 9, 2025 | ransomware_live | — |
| Midsun Group | October 9, 2025 | ransomware_live | — |
| www.datamaxx.com | October 8, 2025 | ransomware_live | — |
| Spectra Logic+DATA | October 8, 2025 | ransomware_live | — |
| Valley Eye Associates | October 8, 2025 | ransomware_live | — |
| Property Tax Consultants | October 7, 2025 | ransomware_live | — |
| Massachusetts Bay Community College | October 7, 2025 | ransomware_live | — |
| Asahi Group Holdings, Ltd. | October 7, 2025 | ransomware_live | — |
| cameronhodges.com | October 7, 2025 | ransomware_live | — |
| Alef Realty, LLC | October 7, 2025 | ransomware_live | — |
| bms.bsd-ri.net | October 6, 2025 | ransomware_live | — |
| Lipapromet | October 6, 2025 | ransomware_live | — |
| ville-saintclaude.fr | October 6, 2025 | ransomware_live | — |
| California Golf Club of San Francisco | October 5, 2025 | ransomware_live | — |
| Uhl | October 4, 2025 | ransomware_live | — |
| AIP Asset Management | October 4, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).