qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| GENERON | February 23, 2026 | ransomware_live | — |
| Spire Payments | February 23, 2026 | ransomware_live | — |
| Rocky Mountain Care | February 23, 2026 | ransomware_live | — |
| US Trading | February 22, 2026 | ransomware_live | — |
| Complete Thermal Svc | February 22, 2026 | ransomware_live | — |
| Maintenance & Project Engineering | February 22, 2026 | ransomware_live | — |
| Tactis | February 22, 2026 | ransomware_live | — |
| Okanogan County Vets | February 22, 2026 | ransomware_live | — |
| North Woodlands Medical Centre | February 22, 2026 | ransomware_live | — |
| AllChem Industries | February 22, 2026 | ransomware_live | — |
| Cumberland International Trucks | February 22, 2026 | ransomware_live | — |
| Esperance Metaland | February 21, 2026 | ransomware_live | — |
| WTSmedia | February 21, 2026 | ransomware_live | — |
| Grupo Tomza | February 21, 2026 | ransomware_live | — |
| Bluefish Dental & Orthodontics | February 21, 2026 | ransomware_live | — |
| ABAR S.p.A. | February 20, 2026 | ransomware_live | — |
| Madison Services, Inc. | February 20, 2026 | ransomware_live | — |
| Graneles de Chile | February 19, 2026 | ransomware_live | — |
| Willow Construction | February 19, 2026 | ransomware_live | — |
| Kensington HPP | February 19, 2026 | ransomware_live | — |
| Kroll International | February 19, 2026 | ransomware_live | — |
| The Corradino Group | February 19, 2026 | ransomware_live | — |
| Diversified Supply Inc. | February 18, 2026 | ransomware_live | — |
| O.Berk | February 18, 2026 | ransomware_live | — |
| University of Mannheim | February 18, 2026 | ransomware_live | — |
| A-Fast Tile & Coping | February 18, 2026 | ransomware_live | — |
| Castle Group | February 17, 2026 | ransomware_live | — |
| Brm | February 17, 2026 | ransomware_live | — |
| Saiful Bouquet | February 17, 2026 | ransomware_live | — |
| Midwest Wheel | February 17, 2026 | ransomware_live | — |
| LaBaguette | February 17, 2026 | ransomware_live | — |
| Tripod Farmers | February 17, 2026 | ransomware_live | — |
| Casartigiani | February 16, 2026 | ransomware_live | — |
| Klevorn | February 16, 2026 | ransomware_live | — |
| JC Resorts | February 14, 2026 | ransomware_live | — |
| Ducasse Comercial Ltda | February 12, 2026 | ransomware_live | — |
| Segue Manufacturing Services | February 12, 2026 | ransomware_live | — |
| Sakata Seed America | February 12, 2026 | ransomware_live | — |
| Conectados Chile S.A. | February 12, 2026 | ransomware_live | — |
| Campbell Rappold & Yurasits | February 12, 2026 | ransomware_live | — |
| Derbez | February 12, 2026 | ransomware_live | — |
| Anchor Computer Systems | February 12, 2026 | ransomware_live | — |
| Mt Barker Co-Operative | February 11, 2026 | ransomware_live | — |
| Castles Technology UK & Ireland | February 11, 2026 | ransomware_live | — |
| PowerON Services | February 11, 2026 | ransomware_live | — |
| ZeroEnergy Design | February 11, 2026 | ransomware_live | — |
| Mississippi Market | February 11, 2026 | ransomware_live | — |
| Lindenhurst Fire Department | February 11, 2026 | ransomware_live | — |
| Cox & Sanchez | February 11, 2026 | ransomware_live | — |
| Andringa Law | February 11, 2026 | ransomware_live | — |
| Topkin & Partlow | February 11, 2026 | ransomware_live | — |
| Tower Insurance Services | February 11, 2026 | ransomware_live | — |
| On-Point Defense Technologies | February 11, 2026 | ransomware_live | — |
| Carrera Casting | February 11, 2026 | ransomware_live | — |
| Anabuki Kosan | February 10, 2026 | ransomware_live | — |
| C4 (Carroll County Cannabis Co. | February 10, 2026 | ransomware_live | — |
| Gradient Wind Engineering | February 9, 2026 | ransomware_live | — |
| Body By Fisher | February 9, 2026 | ransomware_live | — |
| iQ NetSolutions | February 9, 2026 | ransomware_live | — |
| Augusta Housing Authority | February 9, 2026 | ransomware_live | — |
| uniquegas | February 9, 2026 | ransomware_live | — |
| Tech Environmental | February 9, 2026 | ransomware_live | — |
| Voyages Robin | February 8, 2026 | ransomware_live | — |
| AB Data | February 8, 2026 | ransomware_live | — |
| AMR PEMCO | February 7, 2026 | ransomware_live | — |
| PARIS & MARSEILLE | February 7, 2026 | ransomware_live | — |
| voyages-robin.com | February 7, 2026 | ransomware_live | — |
| abdata.com | February 7, 2026 | ransomware_live | — |
| castlestechemea.com | February 7, 2026 | ransomware_live | — |
| poweron.com | February 7, 2026 | ransomware_live | — |
| zeroenergy.com | February 7, 2026 | ransomware_live | — |
| granmanor.org | February 7, 2026 | ransomware_live | — |
| La Fabrica | February 6, 2026 | ransomware_live | — |
| Parente Fireworks | February 6, 2026 | ransomware_live | — |
| PLUS Malaysia Berhad | February 6, 2026 | ransomware_live | — |
| Conpet S.A. (COTE.RO) | February 5, 2026 | ransomware_live | — |
| University of Applied Sciences,Worms | February 5, 2026 | ransomware_live | — |
| RC Collecting | February 4, 2026 | ransomware_live | — |
| JOSE COMBALIA SA | February 4, 2026 | ransomware_live | — |
| ChainPower Technology | February 4, 2026 | ransomware_live | — |
| Chèvre & Rutsch & Herren Notariatsbüro | February 4, 2026 | ransomware_live | — |
| RENAFAN | February 4, 2026 | ransomware_live | — |
| MB Distribution | February 4, 2026 | ransomware_live | — |
| Kopas Cosmetics | February 4, 2026 | ransomware_live | — |
| Medasa | February 3, 2026 | ransomware_live | — |
| Jingchang Enterprise Co., Ltd | February 3, 2026 | ransomware_live | — |
| Stephenson Ziegenhorn & Bernard | February 2, 2026 | ransomware_live | — |
| Sprokkit | February 2, 2026 | ransomware_live | — |
| INGUS | February 2, 2026 | ransomware_live | — |
| Jcm Agricola | February 2, 2026 | ransomware_live | — |
| Exterior Worlds | February 2, 2026 | ransomware_live | — |
| KOUEI | February 2, 2026 | ransomware_live | — |
| The Hechtman Group | February 2, 2026 | ransomware_live | — |
| Range Cooperatives | February 2, 2026 | ransomware_live | — |
| Workers Health & Safety Centre | February 2, 2026 | ransomware_live | — |
| Muebles Dico | February 2, 2026 | ransomware_live | — |
| Medinah School District 11 | February 2, 2026 | ransomware_live | — |
| SoCal ROC | February 1, 2026 | ransomware_live | — |
| Tulsa International Airport | January 30, 2026 | ransomware_live | — |
| Rich Sport Public | January 30, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).