qilin
First seen October 8, 2022Active2,651 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| The Wacks Law Group | July 5, 2024 | ransomware_live | — |
| EHS Partnerships | July 3, 2024 | ransomware_live | — |
| ayurcan | June 27, 2024 | ransomware_live | — |
| YKS | June 25, 2024 | ransomware_live | — |
| promises2kids.org | June 24, 2024 | ransomware_live | — |
| Bunger Steel | June 23, 2024 | ransomware_live | — |
| Wise Construction | June 21, 2024 | ransomware_live | — |
| Synnovis | June 19, 2024 | ransomware_live | — |
| Next Step Healthcare | June 17, 2024 | ransomware_live | — |
| St Vincent de Paul Catholic School | June 17, 2024 | ransomware_live | — |
| pomalca.com.pe | June 17, 2024 | ransomware_live | — |
| kinslerfamilydentistry | June 16, 2024 | ransomware_live | — |
| EnviroApplications | June 14, 2024 | ransomware_live | — |
| Ashtons Legal LLP | June 14, 2024 | ransomware_live | — |
| Bock & Associates, LLP | June 11, 2024 | ransomware_live | — |
| svmasonry.com | June 10, 2024 | ransomware_live | — |
| Allied Toyota Lift | June 7, 2024 | ransomware_live | — |
| Inicio - Ganadería Revuelta | June 5, 2024 | ransomware_live | — |
| www.nuggetent.com | June 5, 2024 | ransomware_live | — |
| goodcents.com | June 5, 2024 | ransomware_live | — |
| Mitchell Industries | June 5, 2024 | ransomware_live | — |
| Development Services Group, Inc. | June 5, 2024 | ransomware_live | — |
| www.colonialbh.org | May 30, 2024 | ransomware_live | — |
| Above All Store Fronts | May 27, 2024 | ransomware_live | — |
| hydefuel.com | May 24, 2024 | ransomware_live | — |
| Datanet | May 23, 2024 | ransomware_live | — |
| Shyang Shin Bao Ind. Co., Ltd. (hereinafter referred to as ''SSB'') | May 17, 2024 | ransomware_live | — |
| a-agroup | May 17, 2024 | ransomware_live | — |
| northcottage.com | May 17, 2024 | ransomware_live | — |
| Municipalité La Guadeloupe | May 13, 2024 | ransomware_live | — |
| PFAM | May 11, 2024 | ransomware_live | — |
| Golden Acre | May 10, 2024 | ransomware_live | — |
| Edlong | May 9, 2024 | ransomware_live | — |
| Holstein Association USA | May 8, 2024 | ransomware_live | — |
| southernspecialtysupply.com | May 7, 2024 | ransomware_live | — |
| The Weinstein Firm | May 6, 2024 | ransomware_live | — |
| All Weather Architectural Aluminum | May 6, 2024 | ransomware_live | — |
| Tohlen Building Technology Group | May 3, 2024 | ransomware_live | — |
| Dr Charles A Evans | May 3, 2024 | ransomware_live | — |
| Logimodal Operações Logísticas | May 3, 2024 | ransomware_live | — |
| FIAB SpA | May 2, 2024 | ransomware_live | — |
| prinsotel.com | May 2, 2024 | ransomware_live | — |
| www.prinsotel.com | May 2, 2024 | ransomware_live | — |
| inforius | April 30, 2024 | ransomware_live | — |
| Tholen Building Technology Group | April 29, 2024 | ransomware_live | — |
| williamsrdm.com | April 19, 2024 | ransomware_live | — |
| watergate | April 18, 2024 | ransomware_live | — |
| etateam.be | April 17, 2024 | ransomware_live | — |
| jean-nouvel | April 17, 2024 | ransomware_live | — |
| Cembell Industries | April 16, 2024 | ransomware_live | — |
| Beloinlaw | April 16, 2024 | ransomware_live | — |
| Intuitae | April 16, 2024 | ransomware_live | — |
| The law firm Dr. Fingerle Rechtsanwälte | April 12, 2024 | ransomware_live | — |
| maccarinelli.it | April 9, 2024 | ransomware_live | — |
| easchangesystems | April 7, 2024 | ransomware_live | — |
| MCS | April 7, 2024 | ransomware_live | — |
| Madero | April 6, 2024 | ransomware_live | — |
| Wacks Law Group | April 3, 2024 | ransomware_live | — |
| W.P.J. McCarthy and Company | April 2, 2024 | ransomware_live | — |
| GRUPOCREATIVO HERRERA | April 2, 2024 | ransomware_live | — |
| Roberson & Sons Insurance Services | April 1, 2024 | ransomware_live | — |
| Summer Fresh | March 27, 2024 | ransomware_live | — |
| L-Pimenta (etdeletronics) | March 27, 2024 | ransomware_live | — |
| SummerFresh | March 26, 2024 | ransomware_live | — |
| Burnham Wood Charter Schools | March 25, 2024 | ransomware_live | — |
| Casa Santiveri | March 22, 2024 | ransomware_live | — |
| ptsmi.co.id | March 21, 2024 | ransomware_live | — |
| Big Issue Group | March 20, 2024 | ransomware_live | — |
| Felda Global Ventures Holdings Berhad | March 13, 2024 | ransomware_live | — |
| brightwires.com.sa | March 6, 2024 | ransomware_live | — |
| hawita-gruppe | March 5, 2024 | ransomware_live | — |
| iemsc.com | February 27, 2024 | ransomware_live | — |
| en-act-architecture | February 27, 2024 | ransomware_live | — |
| GRUPOCREATIVO | February 24, 2024 | ransomware_live | — |
| etairoshealth.com | February 22, 2024 | ransomware_live | — |
| loransrl | February 19, 2024 | ransomware_live | — |
| McSweeney / Langevin | February 19, 2024 | ransomware_live | — |
| kinematica.ch | February 15, 2024 | ransomware_live | — |
| KALEEDS | February 14, 2024 | ransomware_live | — |
| giraud | February 13, 2024 | ransomware_live | — |
| Consulting Radiologists | February 11, 2024 | ransomware_live | — |
| wannago.cloud | February 9, 2024 | ransomware_live | — |
| ZGEO | February 8, 2024 | ransomware_live | — |
| Commonwealth Sign | February 4, 2024 | ransomware_live | — |
| conseguros | February 4, 2024 | ransomware_live | — |
| mordfin | January 28, 2024 | ransomware_live | — |
| neafidi | January 25, 2024 | ransomware_live | — |
| wannagocloud | January 25, 2024 | ransomware_live | — |
| PROJECTSW | January 19, 2024 | ransomware_live | — |
| F J O'Hara & Sons | January 16, 2024 | ransomware_live | — |
| Upper Merion Township | January 15, 2024 | ransomware_live | — |
| hotelcontinental.no | January 12, 2024 | ransomware_live | — |
| ROOSENS BÉTONS | January 11, 2024 | ransomware_live | — |
| molnar&partner | January 10, 2024 | ransomware_live | — |
| Corinth Coca-Cola Bottling Works | January 9, 2024 | ransomware_live | — |
| HALLEONARD | January 8, 2024 | ransomware_live | — |
| EPS.RS | December 27, 2023 | ransomware_live | — |
| Neurology Center of Nevada | December 7, 2023 | ransomware_live | — |
| Ware Manufacturing | December 7, 2023 | ransomware_live | — |
| Accu Reference Medical Lab | December 6, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).