qilin
First seen October 8, 2022Active2,636 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Arnaud | March 26, 2026 | ransomware_live | — |
| Voltamper | March 26, 2026 | ransomware_live | — |
| Maderas Del Noroeste | March 26, 2026 | ransomware_live | — |
| Washoe Tribe | March 26, 2026 | ransomware_live | — |
| Transgas | March 26, 2026 | ransomware_live | — |
| Bedrosians Tile & Stone | March 26, 2026 | ransomware_live | — |
| Louise Medical Center | March 26, 2026 | ransomware_live | — |
| Kaemmerlen Solutions | March 26, 2026 | ransomware_live | — |
| Sacor | March 26, 2026 | ransomware_live | — |
| Netalia | March 26, 2026 | ransomware_live | — |
| Retail Centenario | March 24, 2026 | ransomware_live | — |
| Aroostook Mental Health Services | March 24, 2026 | ransomware_live | — |
| Groupe SFPI | March 23, 2026 | ransomware_live | — |
| Nanometrics | March 23, 2026 | ransomware_live | — |
| Marc Dorcel | March 22, 2026 | ransomware_live | — |
| J E Culp Transport | March 22, 2026 | ransomware_live | — |
| Elite Limousine Plus | March 22, 2026 | ransomware_live | — |
| nPower Technologies | March 22, 2026 | ransomware_live | — |
| Southwire | March 22, 2026 | ransomware_live | — |
| Southern Commercial Real Estate | March 22, 2026 | ransomware_live | — |
| Nanxun Enterprise Co., Ltd. | March 21, 2026 | ransomware_live | — |
| Millerfoto | March 21, 2026 | ransomware_live | — |
| Muffett | March 21, 2026 | ransomware_live | — |
| Grupo Coril | March 21, 2026 | ransomware_live | — |
| VirtualExpo Group | March 20, 2026 | ransomware_live | — |
| AGENCAVI SRL | March 20, 2026 | ransomware_live | — |
| WAL Consultant | March 20, 2026 | ransomware_live | — |
| Denso | March 20, 2026 | ransomware_live | — |
| Enviaseo ESP | March 19, 2026 | ransomware_live | — |
| Accolend | March 19, 2026 | ransomware_live | — |
| GUEGUEN Avocats | March 19, 2026 | ransomware_live | — |
| Affinity Designs | March 18, 2026 | ransomware_live | — |
| L H Lacy | March 18, 2026 | ransomware_live | — |
| Productos La Aguadillana | March 18, 2026 | ransomware_live | — |
| Sievert Electric Service and Sales | March 18, 2026 | ransomware_live | — |
| Jacobs & Sons | March 18, 2026 | ransomware_live | — |
| Arca Service | March 18, 2026 | ransomware_live | — |
| hollu Systemhygiene | March 18, 2026 | ransomware_live | — |
| BTX Global Logistics | March 18, 2026 | ransomware_live | — |
| Biogel | March 16, 2026 | ransomware_live | — |
| Ruhnau Clarke | March 16, 2026 | ransomware_live | — |
| MCC Economics | March 16, 2026 | ransomware_live | — |
| PINNACLE TAX INC | March 16, 2026 | ransomware_live | — |
| Von Weise Associates | March 16, 2026 | ransomware_live | — |
| Salag | March 15, 2026 | ransomware_live | — |
| Duffy's Sports Grill | March 14, 2026 | ransomware_live | — |
| RMZ Oilfield Engineering | March 13, 2026 | ransomware_live | — |
| Millard Manufacturing | March 13, 2026 | ransomware_live | — |
| FMRS Health Systems | March 13, 2026 | ransomware_live | — |
| Alarmco | March 13, 2026 | ransomware_live | — |
| Silvon Software | March 12, 2026 | ransomware_live | — |
| TDS Construction | March 12, 2026 | ransomware_live | — |
| Syed Professional Services | March 12, 2026 | ransomware_live | — |
| Safety Engineering Laboratories | March 12, 2026 | ransomware_live | — |
| Retamar | March 11, 2026 | ransomware_live | — |
| Composition Systems | March 11, 2026 | ransomware_live | — |
| Yuma Sun | March 11, 2026 | ransomware_live | — |
| Curtiembre Austral S.R.L. | March 11, 2026 | ransomware_live | — |
| Omega Optical | March 11, 2026 | ransomware_live | — |
| Jadtec Security Services | March 11, 2026 | ransomware_live | — |
| Powers HVAC | March 11, 2026 | ransomware_live | — |
| Fortress Systems | March 11, 2026 | ransomware_live | — |
| Arimex Importadora | March 11, 2026 | ransomware_live | — |
| Root Security | March 10, 2026 | ransomware_live | — |
| RetireRight Financial Planning | March 10, 2026 | ransomware_live | — |
| Advanced Animations | March 10, 2026 | ransomware_live | — |
| Serviceplan Group (Korea branch) | March 9, 2026 | ransomware_live | — |
| McKenna Pro | March 9, 2026 | ransomware_live | — |
| Pleiad Investment Advisors (Singapore brach) | March 9, 2026 | ransomware_live | — |
| RWB Consulting Engineers | March 9, 2026 | ransomware_live | — |
| AFDL | March 7, 2026 | ransomware_live | — |
| Kuzco Lighting | March 7, 2026 | ransomware_live | — |
| Artemedica | March 7, 2026 | ransomware_live | — |
| Geotec Surveys | March 7, 2026 | ransomware_live | — |
| Dielco | March 7, 2026 | ransomware_live | — |
| Brothers Produce | March 7, 2026 | ransomware_live | — |
| Suchthilfe direkt Essen gGmbH | March 6, 2026 | ransomware_live | — |
| H & L Systems | March 6, 2026 | ransomware_live | — |
| Albany Pumps | March 6, 2026 | ransomware_live | — |
| ASB Saarland | March 6, 2026 | ransomware_live | — |
| Orange Madagascar | March 6, 2026 | ransomware_live | — |
| Waterloo Information Systems | March 6, 2026 | ransomware_live | — |
| Salford City College | March 6, 2026 | ransomware_live | — |
| Lucky Union Foods | March 5, 2026 | ransomware_live | — |
| Michelle Accesorios | March 5, 2026 | ransomware_live | — |
| K & S Company, Inc | March 5, 2026 | ransomware_live | — |
| Tennessee Valley Electric Cooperative | March 5, 2026 | ransomware_live | — |
| Abutriek | March 5, 2026 | ransomware_live | — |
| A Lococo Wholesale | March 5, 2026 | ransomware_live | — |
| ELC Security Products | March 5, 2026 | ransomware_live | — |
| Cheongdam OracleClinic | March 5, 2026 | ransomware_live | — |
| Nopa Industriearmaturen | March 5, 2026 | ransomware_live | — |
| Dr. Pizzoglio | March 4, 2026 | ransomware_live | — |
| Vision Aero | March 4, 2026 | ransomware_live | — |
| ATS Group | March 4, 2026 | ransomware_live | — |
| Golden Clay Industries Sdn Bhd | March 4, 2026 | ransomware_live | — |
| Outsourcia | March 4, 2026 | ransomware_live | — |
| CJL Engineering | March 4, 2026 | ransomware_live | — |
| Lam Soon Group | March 3, 2026 | ransomware_live | — |
| SMF & E.D.Etnyre & BearCat Mfg (3 companies) | March 3, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).