qilin
First seen October 8, 2022Active2,651 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| kanzlei-schramm.com | October 4, 2025 | ransomware_live | — |
| IONODES | October 3, 2025 | ransomware_live | — |
| Corban OneSource | October 3, 2025 | ransomware_live | — |
| Rihatec.de | October 3, 2025 | ransomware_live | — |
| Rihatec Systemlösungen | October 3, 2025 | ransomware_live | — |
| Beta Dyne | October 3, 2025 | ransomware_live | — |
| Saginaw Chippewa Indian Tribe | October 2, 2025 | ransomware_live | — |
| Cooptech.hu | October 2, 2025 | ransomware_live | — |
| Corporate Services | October 2, 2025 | ransomware_live | — |
| Shamir Medical Center | October 2, 2025 | ransomware_live | — |
| South Alabama Regional Planning Commission | October 2, 2025 | ransomware_live | — |
| pratthomes.com | October 1, 2025 | ransomware_live | — |
| Vienneau Insurance | September 30, 2025 | ransomware_live | — |
| Auto Bernhard | September 30, 2025 | ransomware_live | — |
| Mobidic Asset Management | September 30, 2025 | ransomware_live | — |
| Foremost Asset Management | September 30, 2025 | ransomware_live | — |
| www.auto-bernhard.at | September 30, 2025 | ransomware_live | — |
| Price & Ramey Insurance | September 30, 2025 | ransomware_live | — |
| Mecklenburg County Public Schools | September 29, 2025 | ransomware_live | — |
| PTR Asset Management | September 28, 2025 | ransomware_live | — |
| carypeds.com | September 27, 2025 | ransomware_live | — |
| Thomas M Hughes | September 26, 2025 | ransomware_live | — |
| Yooshin Engineering Corporation | September 26, 2025 | ransomware_live | — |
| Hoffman Estates | September 25, 2025 | ransomware_live | — |
| Town of Waxhaw | September 25, 2025 | ransomware_live | — |
| O'Connor Capital Partners | September 25, 2025 | ransomware_live | — |
| WEST | September 25, 2025 | ransomware_live | — |
| Grupo Bocel | September 25, 2025 | ransomware_live | — |
| Hawkins Electrical Service L.L.C Information | September 25, 2025 | ransomware_live | — |
| First Atlantic Capital | September 25, 2025 | ransomware_live | — |
| sperispa.com | September 25, 2025 | ransomware_live | — |
| waxhaw.com | September 25, 2025 | ransomware_live | — |
| Trustar Capital Management Co | September 25, 2025 | ransomware_live | — |
| HUB ASSET MANAGEMENT Co | September 25, 2025 | ransomware_live | — |
| WEST Inc. | September 25, 2025 | ransomware_live | — |
| Pangea Travel Store | September 25, 2025 | ransomware_live | — |
| Officepro | September 24, 2025 | ransomware_live | — |
| kecymetals.com | September 24, 2025 | ransomware_live | — |
| Kecy Metal Technologies | September 24, 2025 | ransomware_live | — |
| Chris Rodriguez Installers | September 23, 2025 | ransomware_live | — |
| APM Finance | September 23, 2025 | ransomware_live | — |
| www.chinup.com.tw | September 23, 2025 | ransomware_live | — |
| www.cr-installers.com | September 23, 2025 | ransomware_live | — |
| www.apm-finance.de | September 23, 2025 | ransomware_live | — |
| NFI North | September 22, 2025 | ransomware_live | — |
| Apex Bulk | September 22, 2025 | ransomware_live | — |
| Edelman&Edelman | September 20, 2025 | ransomware_live | — |
| Goodcents | September 20, 2025 | ransomware_live | — |
| NV ELMAR | September 20, 2025 | ransomware_live | — |
| cegconstruction.com | September 20, 2025 | ransomware_live | — |
| Promociones Luis Barros | September 19, 2025 | ransomware_live | — |
| www.landmarkmgtinc.com | September 19, 2025 | ransomware_live | — |
| Landmark Management | September 19, 2025 | ransomware_live | — |
| Saginaw Chippewa Indian Tribe | September 18, 2025 | ransomware_live | — |
| Dblock Asset Management Co | September 18, 2025 | ransomware_live | — |
| Orum Asset management | September 18, 2025 | ransomware_live | — |
| ST Asset Management Co | September 18, 2025 | ransomware_live | — |
| EOS Asset management | September 18, 2025 | ransomware_live | — |
| Broad High Asset Management | September 18, 2025 | ransomware_live | — |
| EUM Asset Management | September 18, 2025 | ransomware_live | — |
| Mitrani Rynor Adamsky & Toland | September 18, 2025 | ransomware_live | — |
| sagchip.org | September 18, 2025 | ransomware_live | — |
| mcgeorgeai.com | September 18, 2025 | ransomware_live | — |
| McGeorge Architecture Interiors | September 18, 2025 | ransomware_live | — |
| Spartanburg County, SC | September 17, 2025 | ransomware_live | — |
| Prime Asset Fund | September 17, 2025 | ransomware_live | — |
| spartanburgcounty | September 17, 2025 | ransomware_live | — |
| Zebra Asset Management Co | September 17, 2025 | ransomware_live | — |
| Saebom Asset Management | September 17, 2025 | ransomware_live | — |
| SUNIQUE Asset Management Co | September 17, 2025 | ransomware_live | — |
| XCAssociates | September 17, 2025 | ransomware_live | — |
| BiznessHosting | September 16, 2025 | ransomware_live | — |
| Vdyne | September 16, 2025 | ransomware_live | — |
| Office Of The Registrar Of Political Parties | September 14, 2025 | ransomware_live | — |
| LX Asset Management | September 14, 2025 | ransomware_live | — |
| Taurus Investment & Securities Co | September 14, 2025 | ransomware_live | — |
| Melon Asset Management Co. | September 14, 2025 | ransomware_live | — |
| Majesty Asset Management Co. | September 14, 2025 | ransomware_live | — |
| APEX Asset Management | September 14, 2025 | ransomware_live | — |
| VANCHOR Asset Management | September 14, 2025 | ransomware_live | — |
| Awesome Asset Management Co | September 14, 2025 | ransomware_live | — |
| Human and Bridge Asset Management | September 14, 2025 | ransomware_live | — |
| Klarman Asset Management | September 14, 2025 | ransomware_live | — |
| Orleans Parish Sheriff's Office | September 13, 2025 | ransomware_live | — |
| Volume Transportation | September 13, 2025 | ransomware_live | — |
| bio3g.com | September 13, 2025 | ransomware_live | — |
| opso.us | September 13, 2025 | ransomware_live | — |
| [Redacted] #1510 | September 13, 2025 | ransomware_live | — |
| trchealthcare.com | September 13, 2025 | ransomware_live | — |
| Ashe | September 12, 2025 | ransomware_live | — |
| Uvalde Consolidated Independent School District | September 12, 2025 | ransomware_live | — |
| smpeurope.com | September 12, 2025 | ransomware_live | — |
| www.ucisd.net | September 12, 2025 | ransomware_live | — |
| Frisquet | September 12, 2025 | ransomware_live | — |
| TAKwest | September 11, 2025 | ransomware_live | — |
| Pieffe Auto Group | September 11, 2025 | ransomware_live | — |
| Turf Valley Resort Golf Club | September 10, 2025 | ransomware_live | — |
| Spectra Logic | September 10, 2025 | ransomware_live | — |
| port-orange.org | September 9, 2025 | ransomware_live | — |
| Wouters France | September 9, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).