qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Littlefield Companies | January 30, 2026 | ransomware_live | — |
| Esperance Communications | January 30, 2026 | ransomware_live | — |
| Trace | January 30, 2026 | ransomware_live | — |
| Cooperativa de Hostelería de Navarra | January 30, 2026 | ransomware_live | — |
| MBC | January 30, 2026 | ransomware_live | — |
| Keil Erdbau | January 29, 2026 | ransomware_live | — |
| Moontown | January 29, 2026 | ransomware_live | — |
| Plan-IT Office Solutions | January 29, 2026 | ransomware_live | — |
| NessCampbell | January 28, 2026 | ransomware_live | — |
| Service Broadcasting Group | January 28, 2026 | ransomware_live | — |
| KRÜSS | January 28, 2026 | ransomware_live | — |
| Chu & Yang Dental | January 28, 2026 | ransomware_live | — |
| Valbifrut | January 28, 2026 | ransomware_live | — |
| InfoCom | January 28, 2026 | ransomware_live | — |
| Philippine Savings Bank (Metrobank Group) | January 28, 2026 | ransomware_live | — |
| Sukhothai Thammathirat Open University | January 27, 2026 | ransomware_live | — |
| Mills Products | January 26, 2026 | ransomware_live | — |
| Şemsioğlu Uşak Ev Tarhanası | January 25, 2026 | ransomware_live | — |
| OKIN GROUP | January 25, 2026 | ransomware_live | — |
| Centrotherm International | January 25, 2026 | ransomware_live | — |
| CYMOT | January 25, 2026 | ransomware_live | — |
| Milott Laboratories | January 24, 2026 | ransomware_live | — |
| D & D Building | January 24, 2026 | ransomware_live | — |
| Borg Argentina | January 24, 2026 | ransomware_live | — |
| HARTE-BAVENDAMM Rechtsanwlte PartG mbB | January 24, 2026 | ransomware_live | — |
| Herzing | January 24, 2026 | ransomware_live | — |
| Shiffler Equipment Sales | January 24, 2026 | ransomware_live | — |
| YCC Parts Mfg | January 23, 2026 | ransomware_live | — |
| Copetrol | January 22, 2026 | ransomware_live | — |
| Proleasing | January 22, 2026 | ransomware_live | — |
| Farmacias Vilela | January 22, 2026 | ransomware_live | — |
| SiNetCon | January 22, 2026 | ransomware_live | — |
| EDF Group | January 22, 2026 | ransomware_live | — |
| Centro de Desarrollo Emprendedor Ensenada | January 21, 2026 | ransomware_live | — |
| Mutest | January 21, 2026 | ransomware_live | — |
| Altius Geotecnia y Obras Especiales | January 20, 2026 | ransomware_live | — |
| Kontena Nasional Berhad | January 20, 2026 | ransomware_live | — |
| Telecare | January 20, 2026 | ransomware_live | — |
| Casadei | January 19, 2026 | ransomware_live | — |
| Yumark Enterprises | January 19, 2026 | ransomware_live | — |
| Balneario | January 18, 2026 | ransomware_live | — |
| Vietnam Airlines | January 18, 2026 | ransomware_live | — |
| University Volkswagen Mazda | January 18, 2026 | ransomware_live | — |
| Jampen Holzbau AG | January 18, 2026 | ransomware_live | — |
| Dreher Law Firm | January 18, 2026 | ransomware_live | — |
| Colacem | January 17, 2026 | ransomware_live | — |
| UGS | January 17, 2026 | ransomware_live | — |
| Ilumno | January 17, 2026 | ransomware_live | — |
| Laboratorios Smasac | January 17, 2026 | ransomware_live | — |
| Central Roofing South Wales | January 17, 2026 | ransomware_live | — |
| Fluorsid Spa | January 17, 2026 | ransomware_live | — |
| Cary Pediatric Center | January 17, 2026 | ransomware_live | — |
| Orthopaedic Specialists of Massachusetts | January 17, 2026 | ransomware_live | — |
| CFM Mozambique | January 16, 2026 | ransomware_live | — |
| Neo Group | January 15, 2026 | ransomware_live | — |
| Texas State Utilities | January 15, 2026 | ransomware_live | — |
| Krez & Flores | January 15, 2026 | ransomware_live | — |
| PSTECHLTD | January 15, 2026 | ransomware_live | — |
| Bergmanis Preyra | January 15, 2026 | ransomware_live | — |
| Aero-Coating | January 15, 2026 | ransomware_live | — |
| Moen | January 15, 2026 | ransomware_live | — |
| Pathology Associates Of Saint Thomas | January 14, 2026 | ransomware_live | — |
| Designers Mirror and Glass | January 14, 2026 | ransomware_live | — |
| Ernest Maier | January 14, 2026 | ransomware_live | — |
| Gtech | January 14, 2026 | ransomware_live | — |
| Radiant Remodeling | January 14, 2026 | ransomware_live | — |
| Pre-Con Builders | January 14, 2026 | ransomware_live | — |
| Lunsford Capital | January 14, 2026 | ransomware_live | — |
| Superior Water Conditioning | January 12, 2026 | ransomware_live | — |
| G-WAY Microwave | January 12, 2026 | ransomware_live | — |
| Hayden Safe & Lock | January 12, 2026 | ransomware_live | — |
| Best Insurance Agency | January 12, 2026 | ransomware_live | — |
| Young Wealth Management | January 12, 2026 | ransomware_live | — |
| Resource Corporation of America | January 12, 2026 | ransomware_live | — |
| San Silvestre School | January 11, 2026 | ransomware_live | — |
| Sarl Alliance | January 11, 2026 | ransomware_live | — |
| Pensam Residential | January 11, 2026 | ransomware_live | — |
| City of Seal Beach and Seal Beach Police Department | January 11, 2026 | ransomware_live | — |
| Bouygues Energies & Services | January 10, 2026 | ransomware_live | — |
| Telstar-Hommel | January 8, 2026 | ransomware_live | — |
| The Cressi | January 8, 2026 | ransomware_live | — |
| PTS Goldkist Industries Sdn Bhd | January 8, 2026 | ransomware_live | — |
| Anteriad | January 8, 2026 | ransomware_live | — |
| Retrofit Service | January 8, 2026 | ransomware_live | — |
| Spring Grove Area School District | January 8, 2026 | ransomware_live | — |
| Softlab SpA | January 8, 2026 | ransomware_live | — |
| STESAD | January 8, 2026 | ransomware_live | — |
| Gaviota | January 8, 2026 | ransomware_live | — |
| TriVector Services | January 8, 2026 | ransomware_live | — |
| Commercial Paving | January 7, 2026 | ransomware_live | — |
| Sortimage | January 7, 2026 | ransomware_live | — |
| Evergreen Printing | January 7, 2026 | ransomware_live | — |
| Health Bridge Chiropractic | January 6, 2026 | ransomware_live | — |
| Medical Asset Management | January 6, 2026 | ransomware_live | — |
| Secorp Industries | January 6, 2026 | ransomware_live | — |
| USArt | January 6, 2026 | ransomware_live | — |
| Berkmann Wine Cellars | January 6, 2026 | ransomware_live | — |
| Tommotek | January 4, 2026 | ransomware_live | — |
| Cal Spas, Inc. | January 4, 2026 | ransomware_live | — |
| Sönmezler Metal | January 4, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).