qilin
First seen October 8, 2022Active2,651 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Morgenstern AG | August 15, 2025 | ransomware_live | — |
| marma.com.pl | August 15, 2025 | ransomware_live | — |
| Volume Transportation | August 14, 2025 | ransomware_live | — |
| volinc.com | August 14, 2025 | ransomware_live | — |
| Flavor & Fragrance Specialties | August 13, 2025 | ransomware_live | — |
| Ethical Packaging Solutions | August 13, 2025 | ransomware_live | — |
| ffs.com | August 13, 2025 | ransomware_live | — |
| smefazur.fr | August 13, 2025 | ransomware_live | — |
| ethicalpackaging.co.uk | August 13, 2025 | ransomware_live | — |
| Wyong Rugby League Club | August 12, 2025 | ransomware_live | — |
| Northern Construction Service | August 12, 2025 | ransomware_live | — |
| VENTURE Credit Union | August 12, 2025 | ransomware_live | — |
| SYNCADD Systems | August 12, 2025 | ransomware_live | — |
| Assisted Living Pharmacy Service LLC | August 12, 2025 | ransomware_live | — |
| Haeger & Schmidt Logistics | August 12, 2025 | ransomware_live | — |
| northernconstruction.com | August 12, 2025 | ransomware_live | — |
| bvasd.net | August 12, 2025 | ransomware_live | — |
| Ahtna Incorporated | August 12, 2025 | ransomware_live | — |
| Uganda Electricity Transmission Company Limited | August 12, 2025 | ransomware_live | — |
| www.wyongleagues.com.au | August 12, 2025 | ransomware_live | — |
| empur | August 11, 2025 | ransomware_live | — |
| burmann.de | August 11, 2025 | ransomware_live | — |
| Charak Center for Health | August 11, 2025 | ransomware_live | — |
| liabergamo.it | August 11, 2025 | ransomware_live | — |
| Inotiv, Inc | August 11, 2025 | ransomware_live | — |
| Spohn + Burkhardt GmbH & Co KG | August 9, 2025 | ransomware_live | — |
| JTEKT | August 8, 2025 | ransomware_live | — |
| getech.com | August 8, 2025 | ransomware_live | — |
| Lodi Police Department | August 7, 2025 | ransomware_live | — |
| Lawrence Paper | August 7, 2025 | ransomware_live | — |
| CS Repair Services | August 7, 2025 | ransomware_live | — |
| Studebaker Submetering | August 7, 2025 | ransomware_live | — |
| lodipd.org | August 7, 2025 | ransomware_live | — |
| camdon.ca | August 7, 2025 | ransomware_live | — |
| avosinamed.com | August 7, 2025 | ransomware_live | — |
| eyeqmonitoring.com | August 7, 2025 | ransomware_live | — |
| lpco.co | August 7, 2025 | ransomware_live | — |
| Belmont christian college | August 7, 2025 | ransomware_live | — |
| CIMEXSTEEL.CZ | August 7, 2025 | ransomware_live | — |
| Çağrı Group | August 7, 2025 | ransomware_live | — |
| Moniz Silva international | August 6, 2025 | ransomware_live | — |
| Tape Ruvicha | August 6, 2025 | ransomware_live | — |
| ferrocortes | August 6, 2025 | ransomware_live | — |
| Clifford Paper | August 5, 2025 | ransomware_live | — |
| Clifford Paper Inc | August 5, 2025 | ransomware_live | — |
| Bricotech | August 4, 2025 | ransomware_live | — |
| Haaker Equipment | August 4, 2025 | ransomware_live | — |
| easternadjustment.com | August 4, 2025 | ransomware_live | — |
| haaker.com | August 4, 2025 | ransomware_live | — |
| Aggressive Air Compressor & co | August 3, 2025 | ransomware_live | — |
| brebeuf.org | August 3, 2025 | ransomware_live | — |
| fortsmithschools.org | August 1, 2025 | ransomware_live | — |
| envac.es | August 1, 2025 | ransomware_live | — |
| cadex.com | August 1, 2025 | ransomware_live | — |
| ZEF | August 1, 2025 | ransomware_live | — |
| ZEF's | August 1, 2025 | ransomware_live | — |
| CS Repair Services | July 31, 2025 | ransomware_live | — |
| SYNCADD Systems | July 31, 2025 | ransomware_live | — |
| csrepair.com | July 31, 2025 | ransomware_live | — |
| syncadd.com | July 31, 2025 | ransomware_live | — |
| www.afmco.jo | July 30, 2025 | ransomware_live | — |
| tissot.com | July 29, 2025 | ransomware_live | — |
| azurewave.com | July 29, 2025 | ransomware_live | — |
| agrofair | July 29, 2025 | ransomware_live | — |
| moonsafari | July 24, 2025 | ransomware_live | — |
| [Redacted] | July 24, 2025 | ransomware_live | — |
| morgan911.org | July 24, 2025 | ransomware_live | — |
| jaegerndorfer.at | July 23, 2025 | ransomware_live | — |
| JTEKT | July 21, 2025 | ransomware_live | — |
| Krusell | July 21, 2025 | ransomware_live | — |
| chainstoreguide.com | July 21, 2025 | ransomware_live | — |
| danielslawgroupllc.com | July 21, 2025 | ransomware_live | — |
| Metricon Homes | July 21, 2025 | ransomware_live | — |
| jtekt.eu | July 21, 2025 | ransomware_live | — |
| ARCTICGROUP | July 19, 2025 | ransomware_live | — |
| Tiger Communications | July 18, 2025 | ransomware_live | — |
| WIBAIE | July 18, 2025 | ransomware_live | — |
| sotaconstruction.com | July 18, 2025 | ransomware_live | — |
| Specialty Components | July 16, 2025 | ransomware_live | — |
| joseantoniorodriguez.com | July 16, 2025 | ransomware_live | — |
| KEP Credit Union KEP | July 16, 2025 | ransomware_live | — |
| Yapi Teknik Proje | July 16, 2025 | ransomware_live | — |
| Studebaker Submetering | July 15, 2025 | ransomware_live | — |
| ProActive Solutions USA | July 15, 2025 | ransomware_live | — |
| The Paul Wilkinson Law Firm | July 15, 2025 | ransomware_live | — |
| City of Green River | July 15, 2025 | ransomware_live | — |
| WH Rogers Sheet Metal | July 15, 2025 | ransomware_live | — |
| Halvorsen Family Law Group | July 15, 2025 | ransomware_live | — |
| studebakersubmetering.com | July 15, 2025 | ransomware_live | — |
| venturecreditunion.com | July 15, 2025 | ransomware_live | — |
| www.meduane-habitat.fr | July 15, 2025 | ransomware_live | — |
| alpresor.se | July 14, 2025 | ransomware_live | — |
| Adult & Pediatric Dermatology | July 13, 2025 | ransomware_live | — |
| pinnacle Roofing and Exteriors | July 13, 2025 | ransomware_live | — |
| VM Racing | July 13, 2025 | ransomware_live | — |
| apderm.com | July 13, 2025 | ransomware_live | — |
| www.intereum.com | July 11, 2025 | ransomware_live | — |
| fuld.com | July 11, 2025 | ransomware_live | — |
| Media Broadcast Satellite | July 11, 2025 | ransomware_live | — |
| Consorzio di Bonifica Adige Po | July 10, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).