qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sugawara Laboratories | January 2, 2026 | ransomware_live | — |
| Csv Group | January 2, 2026 | ransomware_live | — |
| сj Global | January 2, 2026 | ransomware_live | — |
| NECO Equipment | January 2, 2026 | ransomware_live | — |
| Röben Tonbaustoffe | January 2, 2026 | ransomware_live | — |
| McKenzie SewOn | January 2, 2026 | ransomware_live | — |
| mdm®NT | January 2, 2026 | ransomware_live | — |
| Sai Oral SurgeryOral | January 2, 2026 | ransomware_live | — |
| Jing Cheng Enterprise Co., Ltd. | January 2, 2026 | ransomware_live | — |
| Farmacia San Pablo | January 2, 2026 | ransomware_live | — |
| TaLachaim | December 31, 2025 | ransomware_live | — |
| Quasar | December 31, 2025 | ransomware_live | — |
| Z-Tronix | December 31, 2025 | ransomware_live | — |
| BNZ Materials | December 31, 2025 | ransomware_live | — |
| Luminex Software | December 31, 2025 | ransomware_live | — |
| KOPA Kozmetik A | December 31, 2025 | ransomware_live | — |
| Auforum AG | December 30, 2025 | ransomware_live | — |
| Willowdale Steeplechase | December 29, 2025 | ransomware_live | — |
| Sintac Recycling | December 29, 2025 | ransomware_live | — |
| Grupo Hafesa | December 29, 2025 | ransomware_live | — |
| SEACSUB S.p.a. | December 29, 2025 | ransomware_live | — |
| Atalian | December 28, 2025 | ransomware_live | — |
| Goodwin College | December 28, 2025 | ransomware_live | — |
| Seac | December 28, 2025 | ransomware_live | — |
| Questica | December 28, 2025 | ransomware_live | — |
| Dom Development | December 27, 2025 | ransomware_live | — |
| Typhoo Tea | December 27, 2025 | ransomware_live | — |
| Ortho Mattress | December 26, 2025 | ransomware_live | — |
| Georgia Dermatology & Skin Cancer Center | December 26, 2025 | ransomware_live | — |
| Hometech Window | December 26, 2025 | ransomware_live | — |
| SEIMITSU THAI COMPANY LIMITED | December 25, 2025 | ransomware_live | — |
| Lynn Electrical | December 25, 2025 | ransomware_live | — |
| Madera County Superintendent of Schools | December 25, 2025 | ransomware_live | — |
| Bangchak Corporation | December 25, 2025 | ransomware_live | — |
| Shwapno | December 25, 2025 | ransomware_live | — |
| Universiti Sains Islam Malaysia | December 24, 2025 | ransomware_live | — |
| Eastern Townships School Board | December 24, 2025 | ransomware_live | — |
| Jaf Gifts | December 24, 2025 | ransomware_live | — |
| Shore Gardens Rehabilitation & Nursing Center | December 24, 2025 | ransomware_live | — |
| SW/WC Service Cooperative | December 24, 2025 | ransomware_live | — |
| daispa.it | December 24, 2025 | ransomware_live | — |
| Niradia Enterprises | December 24, 2025 | ransomware_live | — |
| Sipl | December 24, 2025 | ransomware_live | — |
| SV-Büro Ing. Schulz GmbH | December 24, 2025 | ransomware_live | — |
| LogicVein | December 24, 2025 | ransomware_live | — |
| Felix Gonzalez Law Firm | December 24, 2025 | ransomware_live | — |
| Happy Telecom | December 24, 2025 | ransomware_live | — |
| ARO | December 24, 2025 | ransomware_live | — |
| Ellison Educational Equipment | December 24, 2025 | ransomware_live | — |
| loginport | December 23, 2025 | ransomware_live | — |
| ruskcountywi.us | December 23, 2025 | ransomware_live | — |
| Grupo Olé | December 22, 2025 | ransomware_live | — |
| Fürth | December 22, 2025 | ransomware_live | — |
| Lugiano Medical | December 22, 2025 | ransomware_live | — |
| La Papelera | December 22, 2025 | ransomware_live | — |
| Eanes ISD schools | December 22, 2025 | ransomware_live | — |
| Hongfa America | December 22, 2025 | ransomware_live | — |
| GIV SRL | December 22, 2025 | ransomware_live | — |
| Lasercomb | December 22, 2025 | ransomware_live | — |
| Callipo Group | December 22, 2025 | ransomware_live | — |
| National Biscuit Industries | December 22, 2025 | ransomware_live | — |
| Besco Electrical | December 22, 2025 | ransomware_live | — |
| Scenic Solutions | December 22, 2025 | ransomware_live | — |
| Acme Electric | December 22, 2025 | ransomware_live | — |
| Grupo Amanus | December 22, 2025 | ransomware_live | — |
| CoreHQ | December 22, 2025 | ransomware_live | — |
| Cedar Valley Services | December 21, 2025 | ransomware_live | — |
| cc-estuaire | December 21, 2025 | ransomware_live | — |
| Fujitsu Component (Malaysia) SDN. BHD | December 20, 2025 | ransomware_live | — |
| Integrated Technology Group | December 20, 2025 | ransomware_live | — |
| IAPMO | December 20, 2025 | ransomware_live | — |
| Victoria Benelux | December 20, 2025 | ransomware_live | — |
| Egp Comunicaciones Sac | December 20, 2025 | ransomware_live | — |
| Dolan Construction | December 20, 2025 | ransomware_live | — |
| Titan Motor Group | December 20, 2025 | ransomware_live | — |
| Busbusbus | December 20, 2025 | ransomware_live | — |
| MG Chartered Professional Accountant | December 19, 2025 | ransomware_live | — |
| Shah Law Office | December 19, 2025 | ransomware_live | — |
| Josh Steel | December 19, 2025 | ransomware_live | — |
| Club Atlético River Plate | December 19, 2025 | ransomware_live | — |
| Maison Law | December 19, 2025 | ransomware_live | — |
| The Genesis Group | December 19, 2025 | ransomware_live | — |
| Melsing | December 19, 2025 | ransomware_live | — |
| Publicidad Sarmiento | December 19, 2025 | ransomware_live | — |
| Best Hotels Spain | December 18, 2025 | ransomware_live | — |
| Grandes Vinos | December 18, 2025 | ransomware_live | — |
| Ciif | December 17, 2025 | ransomware_live | — |
| Capital + Safi | December 17, 2025 | ransomware_live | — |
| Hr Björkmans Entrémattor | December 17, 2025 | ransomware_live | — |
| Eurofret Transports Et Logistique | December 17, 2025 | ransomware_live | — |
| Pueblo West Colorado | December 17, 2025 | ransomware_live | — |
| Ferreteria Scopazzo | December 17, 2025 | ransomware_live | — |
| PODOVIA | December 17, 2025 | ransomware_live | — |
| Rio supermarket | December 16, 2025 | ransomware_live | — |
| Hodgins Law Group | December 15, 2025 | ransomware_live | — |
| STIC | December 15, 2025 | ransomware_live | — |
| Hopper Developments | December 15, 2025 | ransomware_live | — |
| Region of Istria | December 15, 2025 | ransomware_live | — |
| Dacon Networks | December 15, 2025 | ransomware_live | — |
| Merko Ehitus | December 15, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).