qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Travel Expert | April 25, 2026 | ransomware_live | — |
| Woodfields Consultants | April 25, 2026 | ransomware_live | — |
| Chelten House | April 25, 2026 | ransomware_live | — |
| First County FCU | April 25, 2026 | ransomware_live | — |
| SanCor | April 25, 2026 | ransomware_live | — |
| KEMBA Indianapolis Credit Union | April 25, 2026 | ransomware_live | — |
| Leistritz Turbine Technology | April 25, 2026 | ransomware_live | — |
| Cahbo Produkter | April 25, 2026 | ransomware_live | — |
| Buckley Powder | April 25, 2026 | ransomware_live | — |
| Chase Cooper Limited (RiskLogix Solutions) | April 25, 2026 | ransomware_live | — |
| Grupo ABC | April 24, 2026 | ransomware_live | — |
| Flipo Group | April 24, 2026 | ransomware_live | — |
| Priests for Life | April 24, 2026 | ransomware_live | — |
| Progressive Propane | April 24, 2026 | ransomware_live | — |
| Marc Cain | April 24, 2026 | ransomware_live | — |
| Point Four EPoS Solutions | April 24, 2026 | ransomware_live | — |
| City of Napoleon, Ohio | April 23, 2026 | ransomware_live | — |
| Clearview Intelligence | April 23, 2026 | ransomware_live | — |
| The FAFS | April 23, 2026 | ransomware_live | — |
| Manulife Wealth | April 23, 2026 | ransomware_live | — |
| B to B Visions | April 23, 2026 | ransomware_live | — |
| Roman Catholic Archdiocese of St John | April 21, 2026 | ransomware_live | — |
| Avitrans | April 21, 2026 | ransomware_live | — |
| Ferguson Timar | April 21, 2026 | ransomware_live | — |
| STERIMED | April 21, 2026 | ransomware_live | — |
| PTS Office Systems | April 21, 2026 | ransomware_live | — |
| Huonker GmbH | April 21, 2026 | ransomware_live | — |
| Heartland Steel Products | April 21, 2026 | ransomware_live | — |
| Sea Air International Forwarders | April 21, 2026 | ransomware_live | — |
| Kolin Turkey | April 21, 2026 | ransomware_live | — |
| Industrial Carrocera Arbuciense | April 21, 2026 | ransomware_live | — |
| Cooperativa de Hospitales de Antioquia - COHAN | April 20, 2026 | ransomware_live | — |
| The Go Solution | April 20, 2026 | ransomware_live | — |
| City'Pro | April 20, 2026 | ransomware_live | — |
| SEL (Safety Engineering Laboratory) | April 20, 2026 | ransomware_live | — |
| SafeRain | April 20, 2026 | ransomware_live | — |
| ATKINSON RITSON SOLICITORS LIMITED | April 20, 2026 | ransomware_live | — |
| B&e Juice | April 20, 2026 | ransomware_live | — |
| Hoeren Gartencenter GmbH | April 20, 2026 | ransomware_live | — |
| Henley | April 19, 2026 | ransomware_live | — |
| The Great Cookie | April 19, 2026 | ransomware_live | — |
| HS Technology Group | April 18, 2026 | ransomware_live | — |
| HBX Group | April 17, 2026 | ransomware_live | — |
| Abazia SpA | April 16, 2026 | ransomware_live | — |
| Gruppo ICM SPA | April 15, 2026 | ransomware_live | — |
| Limkon | April 15, 2026 | ransomware_live | — |
| Basalt Dentistry | April 13, 2026 | ransomware_live | — |
| Frutcola Olmué | April 13, 2026 | ransomware_live | — |
| Alternativa de Moda SAS | April 13, 2026 | ransomware_live | — |
| PGDIS.PAPETIQUE PRO | April 13, 2026 | ransomware_live | — |
| Després Mécanique Mobile | April 13, 2026 | ransomware_live | — |
| Herth+Buss | April 13, 2026 | ransomware_live | — |
| Clearwater Marine Aquarium | April 13, 2026 | ransomware_live | — |
| Pangolin Editions | April 11, 2026 | ransomware_live | — |
| Sadtek | April 10, 2026 | ransomware_live | — |
| Peuker & Alexander | April 10, 2026 | ransomware_live | — |
| Guerin Glass | April 10, 2026 | ransomware_live | — |
| TIS | April 10, 2026 | ransomware_live | — |
| Sonn Law Group | April 10, 2026 | ransomware_live | — |
| Autogalerie Heister | April 10, 2026 | ransomware_live | — |
| SAAM Towage | April 10, 2026 | ransomware_live | — |
| Nan Liu Enterprises | April 10, 2026 | ransomware_live | — |
| A Roettgers | April 10, 2026 | ransomware_live | — |
| Chalmers & Kubeck | April 10, 2026 | ransomware_live | — |
| Hofland | April 10, 2026 | ransomware_live | — |
| HIGASHIYAMA INDUSTRIES Co.,Ltd. | April 9, 2026 | ransomware_live | — |
| www.bnc.com.ve | April 7, 2026 | ransomware_live | — |
| Pacific Building Solutions (PBS) | April 6, 2026 | ransomware_live | — |
| Muller Technology | April 6, 2026 | ransomware_live | — |
| Faulkner County Sheriff's Office | April 2, 2026 | ransomware_live | — |
| J Brand | April 2, 2026 | ransomware_live | — |
| State Road and Tollway Authority | April 1, 2026 | ransomware_live | — |
| Die Linke | April 1, 2026 | ransomware_live | — |
| jursaconsulting | April 1, 2026 | ransomware_live | — |
| CHEK News | April 1, 2026 | ransomware_live | — |
| Neurologic Associates Of Central Brevard | April 1, 2026 | ransomware_live | — |
| Q-Lab | March 31, 2026 | ransomware_live | — |
| Chickasaw Holding | March 31, 2026 | ransomware_live | — |
| SERAM SpA | March 31, 2026 | ransomware_live | — |
| Seeing Machines | March 31, 2026 | ransomware_live | — |
| Service Star Freightways | March 31, 2026 | ransomware_live | — |
| Blantyre Capital | March 30, 2026 | ransomware_live | — |
| Miles Electric | March 30, 2026 | ransomware_live | — |
| Summit Tax Advisory | March 30, 2026 | ransomware_live | — |
| Wm Erath & Son | March 30, 2026 | ransomware_live | — |
| Dow | March 30, 2026 | ransomware_live | — |
| Parkway Reality Group | March 30, 2026 | ransomware_live | — |
| Doctor.com | March 29, 2026 | ransomware_live | — |
| International Customer Care Services | March 29, 2026 | ransomware_live | — |
| TR Construya | March 28, 2026 | ransomware_live | — |
| IBB Institut für Bildung und Beratung | March 28, 2026 | ransomware_live | — |
| ACR1.COM Commercial Roofing | March 27, 2026 | ransomware_live | — |
| Kerjaya Prospek Group | March 27, 2026 | ransomware_live | — |
| ITWAL | March 27, 2026 | ransomware_live | — |
| Fondation Boghossian | March 27, 2026 | ransomware_live | — |
| Operinter | March 27, 2026 | ransomware_live | — |
| Noi Hotels | March 26, 2026 | ransomware_live | — |
| LP Kolding | March 26, 2026 | ransomware_live | — |
| Mac Interiors | March 26, 2026 | ransomware_live | — |
| Living in green, s. r. o. | March 26, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).