qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Recsa | July 22, 2026 | ransomware_live | — |
| Primeline Logistics | July 22, 2026 | ransomware_live | — |
| P & A Construction | July 22, 2026 | ransomware_live | — |
| Postres Reina | July 21, 2026 | ransomware_live | — |
| RehaVital Gesundheitsservice GmbH | July 21, 2026 | ransomware_live | — |
| Evergreen Title | July 21, 2026 | ransomware_live | — |
| Bolt & Nut Manufacturing | July 20, 2026 | ransomware_live | — |
| Famesa | July 19, 2026 | ransomware_live | — |
| City Ambulance Service | July 19, 2026 | ransomware_live | — |
| Associated Theatrical Contractors | July 19, 2026 | ransomware_live | — |
| Don Tortaco Mexican Grill | July 19, 2026 | ransomware_live | — |
| Synergy Products | July 19, 2026 | ransomware_live | — |
| Eana | July 19, 2026 | ransomware_live | — |
| PP+K | July 19, 2026 | ransomware_live | — |
| Droguería Martorani | July 18, 2026 | ransomware_live | — |
| Powder River Heating & Air Conditioning | July 18, 2026 | ransomware_live | — |
| AK Preparedness | July 18, 2026 | ransomware_live | — |
| Armara | July 18, 2026 | ransomware_live | — |
| KLD Labs | July 18, 2026 | ransomware_live | — |
| Sicc | July 18, 2026 | ransomware_live | — |
| The Nueva School | July 18, 2026 | ransomware_live | — |
| St Martha Catholic Church | July 18, 2026 | ransomware_live | — |
| Salina Supply | July 18, 2026 | ransomware_live | — |
| Heartland Catfish | July 18, 2026 | ransomware_live | — |
| Acosol | July 17, 2026 | ransomware_live | — |
| Cafar | July 17, 2026 | ransomware_live | — |
| A&E + SMA Design | July 15, 2026 | ransomware_live | — |
| Levin Furniture | July 15, 2026 | ransomware_live | — |
| Feliubadaló | July 15, 2026 | ransomware_live | — |
| International Delights | July 15, 2026 | ransomware_live | — |
| Lercher Werkzeugbau | July 14, 2026 | ransomware_live | — |
| Sedemi | July 14, 2026 | ransomware_live | — |
| THL | July 14, 2026 | ransomware_live | — |
| TitanTV, Inc. | July 13, 2026 | ransomware_live | — |
| URH Hoteliers | July 13, 2026 | ransomware_live | — |
| Hillebrand Home Health | July 13, 2026 | ransomware_live | — |
| Busscar de Colombia | July 13, 2026 | ransomware_live | — |
| Cemoi | July 13, 2026 | ransomware_live | — |
| Jakub A.S. | July 13, 2026 | ransomware_live | — |
| Centro Científico e Cultural de Macau | July 13, 2026 | ransomware_live | — |
| Counts & Dobyns | July 13, 2026 | ransomware_live | — |
| Allied Plumbing & Heating | July 11, 2026 | ransomware_live | — |
| Carolina Agri-Power | July 11, 2026 | ransomware_live | — |
| Retelit SpA PIVA | July 11, 2026 | ransomware_live | — |
| Century Equities | July 11, 2026 | ransomware_live | — |
| Red Planet Hotels | July 10, 2026 | ransomware_live | — |
| CRZ Construcciones | July 10, 2026 | ransomware_live | — |
| Global Strategic Business Process Solutions | July 10, 2026 | ransomware_live | — |
| SPACElogic | July 10, 2026 | ransomware_live | — |
| Navana Real Estate | July 10, 2026 | ransomware_live | — |
| Promotora Zacapu | July 10, 2026 | ransomware_live | — |
| Hilo | July 10, 2026 | ransomware_live | — |
| Eurodefi | July 10, 2026 | ransomware_live | — |
| Peligro Sports | July 9, 2026 | ransomware_live | — |
| Hum & Jacoby | July 9, 2026 | ransomware_live | — |
| Alan F Burke | July 9, 2026 | ransomware_live | — |
| Bronken's Dist | July 9, 2026 | ransomware_live | — |
| Sun Dolphin Boats | July 9, 2026 | ransomware_live | — |
| Sintax | July 9, 2026 | ransomware_live | — |
| Inter Power Engineering | July 9, 2026 | ransomware_live | — |
| S.J. Louis | July 8, 2026 | ransomware_live | — |
| Accelirate | July 7, 2026 | ransomware_live | — |
| Next Clinics | July 7, 2026 | ransomware_live | — |
| COP® Vertriebs-GmbH Zentrale | July 7, 2026 | ransomware_live | — |
| Lechner Massivhaus GmbH | July 7, 2026 | ransomware_live | — |
| LabelDaddy | July 6, 2026 | ransomware_live | — |
| Grupo Inteca | July 6, 2026 | ransomware_live | — |
| Max Fordham | July 6, 2026 | ransomware_live | — |
| Wood Ellis & Wood CPA | July 6, 2026 | ransomware_live | — |
| Answer Precision Tool | July 6, 2026 | ransomware_live | — |
| Precision Steel Services | July 6, 2026 | ransomware_live | — |
| Keystone Homes | July 6, 2026 | ransomware_live | — |
| Groupe Fenwick | July 6, 2026 | ransomware_live | — |
| Sisint | July 3, 2026 | ransomware_live | — |
| Sitmatic | July 3, 2026 | ransomware_live | — |
| Goodwill Manasota | July 3, 2026 | ransomware_live | — |
| Md Lewis | July 3, 2026 | ransomware_live | — |
| TQ Financial Services | July 3, 2026 | ransomware_live | — |
| Pennant Hills Golf Club | July 2, 2026 | ransomware_live | — |
| Dixie Beverage | July 1, 2026 | ransomware_live | — |
| Dynamic Laser Solutions Ltd. | July 1, 2026 | ransomware_live | — |
| Rossum Integration | July 1, 2026 | ransomware_live | — |
| Laughlin Nunnally Hood & Crum | July 1, 2026 | ransomware_live | — |
| Mattatuck Industrial Scrap Metal | July 1, 2026 | ransomware_live | — |
| Dennis Waters Rental Properties | July 1, 2026 | ransomware_live | — |
| Hemmersbach GmbH & Co. KG | June 30, 2026 | ransomware_live | — |
| Chamco | June 30, 2026 | ransomware_live | — |
| NASCO | June 29, 2026 | ransomware_live | — |
| Axionlog | June 29, 2026 | ransomware_live | — |
| Gsma | June 29, 2026 | ransomware_live | — |
| Bristol Place | June 29, 2026 | ransomware_live | — |
| Lam Soon | June 29, 2026 | ransomware_live | — |
| Metal Sur Famin | June 29, 2026 | ransomware_live | — |
| KALIACT ANCHETA et Associs | June 29, 2026 | ransomware_live | — |
| Musashino University | June 29, 2026 | ransomware_live | — |
| Kunert Fashion | June 29, 2026 | ransomware_live | — |
| Transcore | June 28, 2026 | ransomware_live | — |
| 1-800-dentist | June 28, 2026 | ransomware_live | — |
| ISOPLUS | June 25, 2026 | ransomware_live | — |
| Cash Canada | June 24, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).