qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Grupo Logistics | December 15, 2025 | ransomware_live | — |
| Telechaim | December 15, 2025 | ransomware_live | — |
| Tlechaim | December 15, 2025 | ransomware_live | — |
| Vlp Hellas | December 14, 2025 | ransomware_live | — |
| Liteconn Group | December 14, 2025 | ransomware_live | — |
| Kier & Wright | December 14, 2025 | ransomware_live | — |
| The Sonnenschein Groupe | December 14, 2025 | ransomware_live | — |
| Watermark Beach Resort | December 13, 2025 | ransomware_live | — |
| Chema Ballester | December 13, 2025 | ransomware_live | — |
| Vishnick McGovern Milizio | December 13, 2025 | ransomware_live | — |
| The Parkes Companies | December 12, 2025 | ransomware_live | — |
| Oxford Rehabilitation Center | December 12, 2025 | ransomware_live | — |
| Spitzer Auto Group | December 12, 2025 | ransomware_live | — |
| Jeff D'Ambrosio | December 12, 2025 | ransomware_live | — |
| Personal Injury | December 12, 2025 | ransomware_live | — |
| Greene Metal Products | December 12, 2025 | ransomware_live | — |
| Sunshine Group | December 11, 2025 | ransomware_live | — |
| Nepes | December 11, 2025 | ransomware_live | — |
| WJ Professional | December 11, 2025 | ransomware_live | — |
| Dan Technologies Group | December 11, 2025 | ransomware_live | — |
| Hopital La Rabta | December 11, 2025 | ransomware_live | — |
| Cisneros | December 10, 2025 | ransomware_live | — |
| Cdf | December 10, 2025 | ransomware_live | — |
| Vestil Manufacturing | December 10, 2025 | ransomware_live | — |
| Don Ricardo | December 10, 2025 | ransomware_live | — |
| Urban Remedy | December 10, 2025 | ransomware_live | — |
| Sem Val de Bourgogne | December 10, 2025 | ransomware_live | — |
| CIDEF Argentina S.A. | December 10, 2025 | ransomware_live | — |
| Lonich Patton Ehrlich Policastri | December 10, 2025 | ransomware_live | — |
| GROUPE ETMB | December 10, 2025 | ransomware_live | — |
| Serratelli Hat | December 9, 2025 | ransomware_live | — |
| Leandri & Associes | December 9, 2025 | ransomware_live | — |
| TopDest | December 9, 2025 | ransomware_live | — |
| West Quay | December 9, 2025 | ransomware_live | — |
| Hexacon Construction | December 9, 2025 | ransomware_live | — |
| Tupi | December 9, 2025 | ransomware_live | — |
| Teruya Brothers Ltd | December 9, 2025 | ransomware_live | — |
| Canno Design | December 8, 2025 | ransomware_live | — |
| Redi Carpet | December 8, 2025 | ransomware_live | — |
| Poyntell Limited | December 8, 2025 | ransomware_live | — |
| Seipi | December 8, 2025 | ransomware_live | — |
| Cagayan Appliance Center | December 8, 2025 | ransomware_live | — |
| Elite Flower | December 8, 2025 | ransomware_live | — |
| Sanko Air Conditioning Co., Ltd. | December 7, 2025 | ransomware_live | — |
| Marta Montserrat Areny Guerrero ABOGADO | December 7, 2025 | ransomware_live | — |
| AMH Philippines | December 7, 2025 | ransomware_live | — |
| Acoustical Control | December 7, 2025 | ransomware_live | — |
| La Costa Dental Excellence | December 7, 2025 | ransomware_live | — |
| David M. Schwarz Architects | December 7, 2025 | ransomware_live | — |
| UniqueTech Engineering | December 6, 2025 | ransomware_live | — |
| Canvas Church | December 6, 2025 | ransomware_live | — |
| Diesel Electric | December 6, 2025 | ransomware_live | — |
| Kasapreko | December 6, 2025 | ransomware_live | — |
| Khazzan Logistics | December 6, 2025 | ransomware_live | — |
| Towerstream | December 6, 2025 | ransomware_live | — |
| Shumate Mechanical | December 5, 2025 | ransomware_live | — |
| Beecher Walker Architects | December 5, 2025 | ransomware_live | — |
| Yellow Cab of Columbus | December 4, 2025 | ransomware_live | — |
| Peter Meijer Architect | December 4, 2025 | ransomware_live | — |
| Institutional & Supermarket Equipment | December 4, 2025 | ransomware_live | — |
| McManes Law | December 4, 2025 | ransomware_live | — |
| Espaço Casa | December 4, 2025 | ransomware_live | — |
| Scientology | December 4, 2025 | ransomware_live | — |
| Medisend | December 4, 2025 | ransomware_live | — |
| Kana Pipeline Inc | December 4, 2025 | ransomware_live | — |
| NUMALLIANCE | December 3, 2025 | ransomware_live | — |
| City of Urbana | December 3, 2025 | ransomware_live | — |
| Brodosplit | December 3, 2025 | ransomware_live | — |
| LA Injury Attorneys | December 3, 2025 | ransomware_live | — |
| CST Coal | December 3, 2025 | ransomware_live | — |
| Mainetti UK | December 3, 2025 | ransomware_live | — |
| Tlusty & Kennedy | December 2, 2025 | ransomware_live | — |
| Mr Christmas | December 2, 2025 | ransomware_live | — |
| Oriental Castle Sdn Bhd | December 2, 2025 | ransomware_live | — |
| Saca Industrie SpA | December 2, 2025 | ransomware_live | — |
| EDIS | December 2, 2025 | ransomware_live | — |
| GreenBest | December 2, 2025 | ransomware_live | — |
| VENZI & PAGANINI AG | December 2, 2025 | ransomware_live | — |
| Moyes | December 2, 2025 | ransomware_live | — |
| Virtualware Solutions | December 1, 2025 | ransomware_live | — |
| HASCO Hasenclever | December 1, 2025 | ransomware_live | — |
| B dynamic | December 1, 2025 | ransomware_live | — |
| France terre d'asile | December 1, 2025 | ransomware_live | — |
| San Miguel | December 1, 2025 | ransomware_live | — |
| GOOD+ Foundation | December 1, 2025 | ransomware_live | — |
| Battaglioli | November 30, 2025 | ransomware_live | — |
| ILCA Targhe s.r.l. | November 30, 2025 | ransomware_live | — |
| Veton Ai | November 30, 2025 | ransomware_live | — |
| Chenango Valley Technologies | November 29, 2025 | ransomware_live | — |
| CJW | November 29, 2025 | ransomware_live | — |
| TBC Consoles | November 29, 2025 | ransomware_live | — |
| Bomchil | November 29, 2025 | ransomware_live | — |
| Asia Condominium Association | November 29, 2025 | ransomware_live | — |
| Williamson County, TX | November 28, 2025 | ransomware_live | — |
| Weiss | November 28, 2025 | ransomware_live | — |
| Zoya | November 28, 2025 | ransomware_live | — |
| WLR Precision Engineering | November 27, 2025 | ransomware_live | — |
| Santa Paula | November 27, 2025 | ransomware_live | — |
| United Volleyball Supply | November 27, 2025 | ransomware_live | — |
| Bcfpers | November 27, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).