qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| United Association Local Union 345 | August 12, 2026 | ransomware_live | — |
| tommer construction | August 11, 2026 | ransomware_live | — |
| Service Evaluation Concepts | August 11, 2026 | ransomware_live | — |
| Crown Group | August 11, 2026 | ransomware_live | — |
| G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L | August 11, 2026 | ransomware_live | — |
| B Wright Drywall | August 10, 2026 | ransomware_live | — |
| City of Winchester | August 10, 2026 | ransomware_live | — |
| HIGEN MOTOR(critical data) | August 10, 2026 | ransomware_live | — |
| Service d'usinage 9002 | August 9, 2026 | ransomware_live | — |
| Université Libre de Bruxelles | August 9, 2026 | ransomware_live | — |
| Grupo Diestra | August 9, 2026 | ransomware_live | — |
| Phithan Phanich | August 9, 2026 | ransomware_live | — |
| Naval Interior Team | August 9, 2026 | ransomware_live | — |
| Price Shoes | August 9, 2026 | ransomware_live | — |
| Harplast SRL | August 9, 2026 | ransomware_live | — |
| pm-energy Die Solarexperten | August 9, 2026 | ransomware_live | — |
| Chun Tai Sing Chemical Industry | August 9, 2026 | ransomware_live | — |
| East Field Corporation | August 9, 2026 | ransomware_live | — |
| Panda Logistics Taichung Branch | August 9, 2026 | ransomware_live | — |
| Energetic Development Corp | August 9, 2026 | ransomware_live | — |
| Synergy Interactive | August 9, 2026 | ransomware_live | — |
| CLLS Co Ltd | August 8, 2026 | ransomware_live | — |
| Clausing | August 8, 2026 | ransomware_live | — |
| Impact Centre Chrétien | August 8, 2026 | ransomware_live | — |
| Depona | August 7, 2026 | ransomware_live | — |
| Nikan Awasisak Agency | August 7, 2026 | ransomware_live | — |
| John C Saunders, CPA | August 7, 2026 | ransomware_live | — |
| EISNER ZT GMBH | August 7, 2026 | ransomware_live | — |
| Filtronic | August 7, 2026 | ransomware_live | — |
| Astro Electroplating | August 7, 2026 | ransomware_live | — |
| J&T Bank and Trust | August 6, 2026 | ransomware_live | — |
| Akuur Law Firm | August 6, 2026 | ransomware_live | — |
| Jakle & Alexander | August 6, 2026 | ransomware_live | — |
| ALIZE (alize-sud.fr) | August 6, 2026 | ransomware_live | — |
| AmSpec | August 6, 2026 | ransomware_live | — |
| Crystal Pharmatech | August 6, 2026 | ransomware_live | — |
| Stade Francais | August 5, 2026 | ransomware_live | — |
| STADLER Sensorik CNC-Technik | August 5, 2026 | ransomware_live | — |
| Mera Metal | August 5, 2026 | ransomware_live | — |
| WD Masonry & Concrete | August 4, 2026 | ransomware_live | — |
| RUPP Spritzguss | August 4, 2026 | ransomware_live | — |
| Galvin Brothers | August 4, 2026 | ransomware_live | — |
| Bloom Financials | August 4, 2026 | ransomware_live | — |
| Freedom Claims Management | August 3, 2026 | ransomware_live | — |
| Service Electric | August 3, 2026 | ransomware_live | — |
| Universitatea De Vest Vasile Goldi Din Arad | August 3, 2026 | ransomware_live | — |
| Wire Products | August 2, 2026 | ransomware_live | — |
| Mairie de Drancy | August 2, 2026 | ransomware_live | — |
| Asset Flooring Group Australia | August 2, 2026 | ransomware_live | — |
| INTERTRUST AUSTRALIA PTY LTD | August 2, 2026 | ransomware_live | — |
| Schreiner Trockenbau GmbH | August 1, 2026 | ransomware_live | — |
| Pointe Property Group | August 1, 2026 | ransomware_live | — |
| Ceragres | August 1, 2026 | ransomware_live | — |
| Dienst Pack Systems | August 1, 2026 | ransomware_live | — |
| Commercial Furniture Interiors | August 1, 2026 | ransomware_live | — |
| The Saturday Evening Post | August 1, 2026 | ransomware_live | — |
| Hawaii Family Dental | July 31, 2026 | ransomware_live | reported in press coverage |
| The Dcoop | July 31, 2026 | ransomware_live | — |
| Community Management Associates | July 31, 2026 | ransomware_live | — |
| Indian Motos Inmot | July 30, 2026 | ransomware_live | — |
| Orimar | July 30, 2026 | ransomware_live | — |
| servitelco | July 30, 2026 | ransomware_live | — |
| Adpo | July 30, 2026 | ransomware_live | — |
| Affinity Capital | July 30, 2026 | ransomware_live | — |
| Excel Consultores | July 30, 2026 | ransomware_live | — |
| Prenisac | July 30, 2026 | ransomware_live | — |
| Byonyks | July 30, 2026 | ransomware_live | — |
| Db Tarimsal Enerji | July 30, 2026 | ransomware_live | — |
| TenSparrows | July 30, 2026 | ransomware_live | — |
| Audio Precision, Inc | July 30, 2026 | ransomware_live | — |
| Gran valle negocios | July 28, 2026 | ransomware_live | — |
| Hoc | July 28, 2026 | ransomware_live | — |
| Wilbert's | July 27, 2026 | ransomware_live | — |
| Savills France | July 27, 2026 | ransomware_live | — |
| Universitatea de Vest „Vasile Goldiș” din Arad | July 26, 2026 | ransomware_live | — |
| Contacto Garantido | July 26, 2026 | ransomware_live | — |
| GURR Abdichtungstechnik GmbH | July 25, 2026 | ransomware_live | — |
| Principle Diagnostics Laboratory | July 25, 2026 | ransomware_live | — |
| Guntert & Zimmerman | July 25, 2026 | ransomware_live | — |
| The Myers Y Cooper | July 25, 2026 | ransomware_live | — |
| Plitvička Jezera Nacionalni Park | July 25, 2026 | ransomware_live | — |
| Jubilee Jobs | July 25, 2026 | ransomware_live | — |
| Highline Community College | July 24, 2026 | ransomware_live | — |
| Kean University | July 24, 2026 | ransomware_live | — |
| Ejército Argentino | July 24, 2026 | ransomware_live | — |
| Stryker | July 24, 2026 | ransomware_live | — |
| GOP | July 24, 2026 | ransomware_live | — |
| Sunway Berhad | July 23, 2026 | ransomware_live | — |
| AppleOne Properties | July 23, 2026 | ransomware_live | — |
| Triton Trading | July 23, 2026 | ransomware_live | — |
| Cano Industrial | July 23, 2026 | ransomware_live | — |
| Assos Pharmaceuticals | July 23, 2026 | ransomware_live | — |
| Corporate 360 Business Solutions | July 23, 2026 | ransomware_live | — |
| WellPerf | July 23, 2026 | ransomware_live | — |
| ABM Enviro | July 23, 2026 | ransomware_live | — |
| Machinerie P&W | July 23, 2026 | ransomware_live | — |
| Infina Health | July 22, 2026 | ransomware_live | — |
| EFU Life Assurance | July 22, 2026 | ransomware_live | — |
| Cpcg | July 22, 2026 | ransomware_live | — |
| Salida Union School District | July 22, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).