qilin
First seen October 8, 2022Active2,651 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.cmic-cmo.com | April 30, 2025 | ransomware_live | — |
| SoloVue | April 29, 2025 | ransomware_live | — |
| cwcglobal.com | April 29, 2025 | ransomware_live | — |
| RC Manubhai | April 28, 2025 | ransomware_live | — |
| Megachem Singapore | April 28, 2025 | ransomware_live | — |
| www.southlandscs.com | April 27, 2025 | ransomware_live | — |
| www.nexus.edu.my | April 25, 2025 | ransomware_live | — |
| www.unitedcaps.com | April 23, 2025 | ransomware_live | — |
| parrishleasing.com | April 22, 2025 | ransomware_live | — |
| rfsd13.org | April 22, 2025 | ransomware_live | — |
| Dominion Lending Centres | April 21, 2025 | ransomware_live | — |
| Whitley Law Firm | April 21, 2025 | ransomware_live | — |
| bostonconveyorandautomation.com | April 20, 2025 | ransomware_live | — |
| Capital Trade | April 19, 2025 | ransomware_live | — |
| The Michelson Organization | April 19, 2025 | ransomware_live | — |
| www.captrade.com | April 19, 2025 | ransomware_live | — |
| bertie.k12.nc.us | April 17, 2025 | ransomware_live | — |
| universalwindow.com | April 17, 2025 | ransomware_live | — |
| yankeetrails.com | April 17, 2025 | ransomware_live | — |
| www.nelson.edu | April 16, 2025 | ransomware_live | — |
| gates-cooper.com | April 16, 2025 | ransomware_live | — |
| a-1freeman | April 15, 2025 | ransomware_live | — |
| CDI | April 14, 2025 | ransomware_live | — |
| NL Olson & Associates | April 14, 2025 | ransomware_live | — |
| Pratt Homes | April 14, 2025 | ransomware_live | — |
| FEELFOUR | April 13, 2025 | ransomware_live | — |
| Richmond СPA | April 13, 2025 | ransomware_live | — |
| Mapaex | April 12, 2025 | ransomware_live | — |
| MS SUPPLY CHAIN SOLUTIONS (MALAYSIA) SDN. BHD | April 12, 2025 | ransomware_live | — |
| 1sthealthinc.com | April 12, 2025 | ransomware_live | — |
| Algas Engineering Pte Ltd - Algas Engineering | April 10, 2025 | ransomware_live | — |
| sk.com | April 10, 2025 | ransomware_live | — |
| Bangkok Electronics Co., Ltd | April 9, 2025 | ransomware_live | — |
| lawforpersonalinjury.com | April 9, 2025 | ransomware_live | — |
| sunbayhotel.com | April 7, 2025 | ransomware_live | — |
| Optimax Technology | April 5, 2025 | ransomware_live | — |
| yumaspazio.com | April 4, 2025 | ransomware_live | — |
| dgr.at | April 4, 2025 | ransomware_live | — |
| raymurray.com | April 4, 2025 | ransomware_live | — |
| CCHC Healthcare | April 3, 2025 | ransomware_live | — |
| caliendoarchitects.com | April 2, 2025 | ransomware_live | — |
| www.gchd.org | April 2, 2025 | ransomware_live | — |
| www.latouchepediatrics.com | March 31, 2025 | ransomware_live | — |
| Dermatologists of Birmingham | March 31, 2025 | ransomware_live | — |
| TEPAS | March 30, 2025 | ransomware_live | — |
| blainemn.gov | March 30, 2025 | ransomware_live | — |
| agakam | March 28, 2025 | ransomware_live | — |
| mmmbs.net | March 28, 2025 | ransomware_live | — |
| frazerllp.com | March 28, 2025 | ransomware_live | — |
| bedfordma.gov | March 28, 2025 | ransomware_live | — |
| Wildeck Inc | March 27, 2025 | ransomware_live | — |
| Ebassi.com (E.B. Archbald and Associates) | March 26, 2025 | ransomware_live | — |
| Groupe des Industries Métallurgiques | March 24, 2025 | ransomware_live | — |
| derianhouse.co.uk | March 24, 2025 | ransomware_live | — |
| MALAYSIA AIRPORTS HOLDINGS BERHAD | March 23, 2025 | ransomware_live | — |
| MALAYSIA AIRPORTS HOLDINGS BERHAD Part 1 of data taken !!! | March 23, 2025 | ransomware_live | — |
| Doumen | March 22, 2025 | ransomware_live | — |
| govcz | March 22, 2025 | ransomware_live | — |
| hardmanjohnston.com | March 21, 2025 | ransomware_live | — |
| nccer.org | March 21, 2025 | ransomware_live | — |
| Luff Industries | March 20, 2025 | ransomware_live | — |
| blue-hive.com | March 20, 2025 | ransomware_live | — |
| Cleveland Municipal Court | March 18, 2025 | ransomware_live | — |
| SMC Corporation | March 17, 2025 | ransomware_live | — |
| Diode Technologies | March 17, 2025 | ransomware_live | — |
| Worldlawn Power Equipment | March 17, 2025 | ransomware_live | — |
| Lepant Law Office | March 17, 2025 | ransomware_live | — |
| Groupe Sinari | March 17, 2025 | ransomware_live | — |
| Sinari's software POC | March 17, 2025 | ransomware_live | — |
| Ricardo Rodriguez | March 15, 2025 | ransomware_live | — |
| www.ancc.org | March 15, 2025 | ransomware_live | — |
| charlesjones.ca | March 14, 2025 | ransomware_live | — |
| The Holiday:Adult Care Community & Retirement Homes | March 14, 2025 | ransomware_live | — |
| PTS Group | March 13, 2025 | ransomware_live | — |
| Yushin America, Inc | March 12, 2025 | ransomware_live | — |
| Suder&Suder | March 11, 2025 | ransomware_live | — |
| Dacas Argentina | March 10, 2025 | ransomware_live | — |
| CAHOKIA CUSD 187 SCHOOL DISTRICT | March 8, 2025 | ransomware_live | — |
| The Komec | March 8, 2025 | ransomware_live | — |
| prelco.ca | March 7, 2025 | ransomware_live | — |
| Los Madroños Hospital | March 7, 2025 | ransomware_live | — |
| Wheels and Deals | March 7, 2025 | ransomware_live | — |
| Ministry of Foreign Affairs of Ukraine | March 6, 2025 | ransomware_live | — |
| Connekted, Inc. | March 6, 2025 | ransomware_live | — |
| Subsurfco LLC | March 5, 2025 | ransomware_live | — |
| PFS Grupo - Plan de igualdad, Sostenibilidad | March 4, 2025 | ransomware_live | — |
| Chicago Doorways, LLC | March 4, 2025 | ransomware_live | — |
| Houston Symphony | February 28, 2025 | ransomware_live | — |
| bpmmicro.com | February 28, 2025 | ransomware_live | — |
| gettys.com | February 28, 2025 | ransomware_live | — |
| Soco systems | February 27, 2025 | ransomware_live | — |
| Lee Enterprises | February 27, 2025 | ransomware_live | — |
| peruzzi.com | February 27, 2025 | ransomware_live | — |
| Surface 678 | February 26, 2025 | ransomware_live | — |
| Sound Ideas | February 26, 2025 | ransomware_live | — |
| Utsunomiya Central Clinic | February 26, 2025 | ransomware_live | — |
| rockhillwc.com | February 26, 2025 | ransomware_live | — |
| yuagam | February 25, 2025 | ransomware_live | — |
| Metro Supply Chain Group. | February 24, 2025 | ransomware_live | — |
| HOST Software Entwicklung und Consulting GmbH | February 24, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).