qilin
First seen October 8, 2022Active2,262 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Fluorsid Spa | January 17, 2026 | ransomware_live | — |
| Cary Pediatric Center | January 17, 2026 | ransomware_live | — |
| Orthopaedic Specialists of Massachusetts | January 17, 2026 | ransomware_live | — |
| CFM Mozambique | January 16, 2026 | ransomware_live | — |
| Neo Group | January 15, 2026 | ransomware_live | — |
| Texas State Utilities | January 15, 2026 | ransomware_live | — |
| Krez & Flores | January 15, 2026 | ransomware_live | — |
| PSTECHLTD | January 15, 2026 | ransomware_live | — |
| Bergmanis Preyra | January 15, 2026 | ransomware_live | — |
| Aero-Coating | January 15, 2026 | ransomware_live | — |
| Moen | January 15, 2026 | ransomware_live | — |
| Pathology Associates Of Saint Thomas | January 14, 2026 | ransomware_live | — |
| Designers Mirror and Glass | January 14, 2026 | ransomware_live | — |
| Ernest Maier | January 14, 2026 | ransomware_live | — |
| Gtech | January 14, 2026 | ransomware_live | — |
| Radiant Remodeling | January 14, 2026 | ransomware_live | — |
| Pre-Con Builders | January 14, 2026 | ransomware_live | — |
| Lunsford Capital | January 14, 2026 | ransomware_live | — |
| Superior Water Conditioning | January 12, 2026 | ransomware_live | — |
| G-WAY Microwave | January 12, 2026 | ransomware_live | — |
| Hayden Safe & Lock | January 12, 2026 | ransomware_live | — |
| Best Insurance Agency | January 12, 2026 | ransomware_live | — |
| Young Wealth Management | January 12, 2026 | ransomware_live | — |
| Resource Corporation of America | January 12, 2026 | ransomware_live | — |
| San Silvestre School | January 11, 2026 | ransomware_live | — |
| Sarl Alliance | January 11, 2026 | ransomware_live | — |
| Pensam Residential | January 11, 2026 | ransomware_live | — |
| City of Seal Beach and Seal Beach Police Department | January 11, 2026 | ransomware_live | — |
| Bouygues Energies & Services | January 10, 2026 | ransomware_live | — |
| Telstar-Hommel | January 8, 2026 | ransomware_live | — |
| The Cressi | January 8, 2026 | ransomware_live | — |
| PTS Goldkist Industries Sdn Bhd | January 8, 2026 | ransomware_live | — |
| Anteriad | January 8, 2026 | ransomware_live | — |
| Retrofit Service | January 8, 2026 | ransomware_live | — |
| Spring Grove Area School District | January 8, 2026 | ransomware_live | — |
| Softlab SpA | January 8, 2026 | ransomware_live | — |
| STESAD | January 8, 2026 | ransomware_live | — |
| Gaviota | January 8, 2026 | ransomware_live | — |
| TriVector Services | January 8, 2026 | ransomware_live | — |
| Commercial Paving | January 7, 2026 | ransomware_live | — |
| Sortimage | January 7, 2026 | ransomware_live | — |
| Evergreen Printing | January 7, 2026 | ransomware_live | — |
| Health Bridge Chiropractic | January 6, 2026 | ransomware_live | — |
| Medical Asset Management | January 6, 2026 | ransomware_live | — |
| Secorp Industries | January 6, 2026 | ransomware_live | — |
| USArt | January 6, 2026 | ransomware_live | — |
| Berkmann Wine Cellars | January 6, 2026 | ransomware_live | — |
| Tommotek | January 4, 2026 | ransomware_live | — |
| Cal Spas, Inc. | January 4, 2026 | ransomware_live | — |
| Sönmezler Metal | January 4, 2026 | ransomware_live | — |
| Sugawara Laboratories | January 2, 2026 | ransomware_live | — |
| Csv Group | January 2, 2026 | ransomware_live | — |
| сj Global | January 2, 2026 | ransomware_live | — |
| NECO Equipment | January 2, 2026 | ransomware_live | — |
| Röben Tonbaustoffe | January 2, 2026 | ransomware_live | — |
| McKenzie SewOn | January 2, 2026 | ransomware_live | — |
| mdm®NT | January 2, 2026 | ransomware_live | — |
| Sai Oral SurgeryOral | January 2, 2026 | ransomware_live | — |
| Jing Cheng Enterprise Co., Ltd. | January 2, 2026 | ransomware_live | — |
| Farmacia San Pablo | January 2, 2026 | ransomware_live | — |
| TaLachaim | December 31, 2025 | ransomware_live | — |
| Quasar | December 31, 2025 | ransomware_live | — |
| Z-Tronix | December 31, 2025 | ransomware_live | — |
| BNZ Materials | December 31, 2025 | ransomware_live | — |
| Luminex Software | December 31, 2025 | ransomware_live | — |
| KOPA Kozmetik A | December 31, 2025 | ransomware_live | — |
| Auforum AG | December 30, 2025 | ransomware_live | — |
| Willowdale Steeplechase | December 29, 2025 | ransomware_live | — |
| Sintac Recycling | December 29, 2025 | ransomware_live | — |
| Grupo Hafesa | December 29, 2025 | ransomware_live | — |
| SEACSUB S.p.a. | December 29, 2025 | ransomware_live | — |
| Atalian | December 28, 2025 | ransomware_live | — |
| Goodwin College | December 28, 2025 | ransomware_live | — |
| Seac | December 28, 2025 | ransomware_live | — |
| Questica | December 28, 2025 | ransomware_live | — |
| Dom Development | December 27, 2025 | ransomware_live | — |
| Typhoo Tea | December 27, 2025 | ransomware_live | — |
| Ortho Mattress | December 26, 2025 | ransomware_live | — |
| Georgia Dermatology & Skin Cancer Center | December 26, 2025 | ransomware_live | — |
| Hometech Window | December 26, 2025 | ransomware_live | — |
| SEIMITSU THAI COMPANY LIMITED | December 25, 2025 | ransomware_live | — |
| Lynn Electrical | December 25, 2025 | ransomware_live | — |
| Madera County Superintendent of Schools | December 25, 2025 | ransomware_live | — |
| Bangchak Corporation | December 25, 2025 | ransomware_live | — |
| Shwapno | December 25, 2025 | ransomware_live | — |
| Universiti Sains Islam Malaysia | December 24, 2025 | ransomware_live | — |
| Eastern Townships School Board | December 24, 2025 | ransomware_live | — |
| Jaf Gifts | December 24, 2025 | ransomware_live | — |
| Shore Gardens Rehabilitation & Nursing Center | December 24, 2025 | ransomware_live | — |
| SW/WC Service Cooperative | December 24, 2025 | ransomware_live | — |
| daispa.it | December 24, 2025 | ransomware_live | — |
| Niradia Enterprises | December 24, 2025 | ransomware_live | — |
| Sipl | December 24, 2025 | ransomware_live | — |
| SV-Büro Ing. Schulz GmbH | December 24, 2025 | ransomware_live | — |
| LogicVein | December 24, 2025 | ransomware_live | — |
| Felix Gonzalez Law Firm | December 24, 2025 | ransomware_live | — |
| Happy Telecom | December 24, 2025 | ransomware_live | — |
| ARO | December 24, 2025 | ransomware_live | — |
| Ellison Educational Equipment | December 24, 2025 | ransomware_live | — |
| loginport | December 23, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).