qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| echolakefoods.com | October 29, 2025 | ransomware_live | — |
| chirhochiropractic.com | October 29, 2025 | ransomware_live | — |
| upea.com | October 29, 2025 | ransomware_live | — |
| renrns.com | October 29, 2025 | ransomware_live | — |
| Truro Cannabis | October 29, 2025 | ransomware_live | — |
| Super Value | October 29, 2025 | ransomware_live | — |
| reesegroupinc.com | October 29, 2025 | ransomware_live | — |
| Productive Tool Products | October 28, 2025 | ransomware_live | — |
| Lorber, Greenfield & Polito, LLP | October 28, 2025 | ransomware_live | — |
| Domy | October 27, 2025 | ransomware_live | — |
| Izaki Group Investments | October 27, 2025 | ransomware_live | — |
| Henrietta Ezeoke Law Firm | October 27, 2025 | ransomware_live | — |
| Micke Stridh Maskin | October 27, 2025 | ransomware_live | — |
| Mainetti UK - Data breach | October 27, 2025 | ransomware_live | — |
| Double Oak Construction | October 27, 2025 | ransomware_live | — |
| MedImpact Healthcare | October 27, 2025 | ransomware_live | — |
| COTTAGE | October 27, 2025 | ransomware_live | — |
| InfraCom Group | October 26, 2025 | ransomware_live | — |
| Gandía Palace Hotel | October 26, 2025 | ransomware_live | — |
| Omrin | October 25, 2025 | ransomware_live | — |
| Kaufman & Stigger | October 25, 2025 | ransomware_live | — |
| Zacho-Lind | October 25, 2025 | ransomware_live | — |
| City of Sugar Land | October 25, 2025 | ransomware_live | — |
| Essential Cabinetry Group | October 25, 2025 | ransomware_live | — |
| Doha British School | October 24, 2025 | ransomware_live | — |
| Malgor | October 24, 2025 | ransomware_live | — |
| Gericke AG | October 23, 2025 | ransomware_live | — |
| IREM companies | October 23, 2025 | ransomware_live | — |
| Northern Light Technologies | October 22, 2025 | ransomware_live | — |
| Applied Technology Resources | October 22, 2025 | ransomware_live | — |
| KIS Asset Evaluation | October 22, 2025 | ransomware_live | — |
| Magna Hospitality Group | October 22, 2025 | ransomware_live | — |
| More Than Gourmet | October 22, 2025 | ransomware_live | — |
| CHDFS | October 22, 2025 | ransomware_live | — |
| Samera Health | October 22, 2025 | ransomware_live | — |
| Real Estate Specialists | October 22, 2025 | ransomware_live | — |
| KHL Printing | October 22, 2025 | ransomware_live | — |
| Grupo Promasa | October 22, 2025 | ransomware_live | — |
| Signet Armorlite, Inc. | October 22, 2025 | ransomware_live | — |
| Integral Networks | October 22, 2025 | ransomware_live | — |
| NurseSpring | October 22, 2025 | ransomware_live | — |
| ClearCare Periodontal & Implant Centre | October 22, 2025 | ransomware_live | — |
| Clayco Electric | October 22, 2025 | ransomware_live | — |
| Tri City Foods | October 21, 2025 | ransomware_live | — |
| Long Island Weight Loss Institute | October 19, 2025 | ransomware_live | — |
| Stowaway Storage | October 19, 2025 | ransomware_live | — |
| Cellini Design Center | October 19, 2025 | ransomware_live | — |
| Gas Generator Solutions | October 19, 2025 | ransomware_live | — |
| Octomeca OY | October 19, 2025 | ransomware_live | — |
| BARCO Rent-A-Truck | October 19, 2025 | ransomware_live | — |
| Grande Prairie Public Library | October 19, 2025 | ransomware_live | — |
| Indian Spring Country Club | October 19, 2025 | ransomware_live | — |
| SIGN Fracture Care International | October 19, 2025 | ransomware_live | — |
| Wassa, SRO | October 19, 2025 | ransomware_live | — |
| Winholt Equipment Group | October 19, 2025 | ransomware_live | — |
| Sports Medicine and Orthopaedics | October 19, 2025 | ransomware_live | — |
| Platinum Wines & Spirits | October 19, 2025 | ransomware_live | — |
| The Blood and Marrow Transplant Group of Georgia | October 19, 2025 | ransomware_live | — |
| Klima-Therm | October 19, 2025 | ransomware_live | — |
| Distribuciones Camba | October 19, 2025 | ransomware_live | — |
| Kudela & Weinheimer | October 19, 2025 | ransomware_live | — |
| SANgel | October 19, 2025 | ransomware_live | — |
| Khatami Law | October 19, 2025 | ransomware_live | — |
| Laloma | October 19, 2025 | ransomware_live | — |
| Scales Sales & Service | October 19, 2025 | ransomware_live | — |
| London Women's Clinic | October 19, 2025 | ransomware_live | — |
| Stephenson's Rental Services | October 19, 2025 | ransomware_live | — |
| BIOPHARMEX, SA de CV | October 19, 2025 | ransomware_live | — |
| JA Jennings | October 19, 2025 | ransomware_live | — |
| arizonafireplaces.com | October 16, 2025 | ransomware_live | — |
| coppage.net | October 16, 2025 | ransomware_live | — |
| pcdpackaging.com | October 16, 2025 | ransomware_live | — |
| arpis.com | October 16, 2025 | ransomware_live | — |
| gslong.com | October 16, 2025 | ransomware_live | — |
| dalton.com | October 16, 2025 | ransomware_live | — |
| montship.ca | October 16, 2025 | ransomware_live | — |
| pandarose.ca | October 16, 2025 | ransomware_live | — |
| halifax.k12.va.us | October 16, 2025 | ransomware_live | — |
| LEYHAUSEN Research | October 15, 2025 | ransomware_live | — |
| Commune De Saint Claude | October 15, 2025 | ransomware_live | — |
| Asahi Group Holdings | October 15, 2025 | ransomware_live | — |
| ville-elne | October 15, 2025 | ransomware_live | — |
| Wheale Law Firm | October 15, 2025 | ransomware_live | — |
| TF LE TOIT FOREZIEN | October 15, 2025 | ransomware_live | — |
| Florida Marking Products | October 15, 2025 | ransomware_live | — |
| Bay West | October 15, 2025 | ransomware_live | — |
| Victory Christian Center | October 15, 2025 | ransomware_live | — |
| Pangea | October 15, 2025 | ransomware_live | — |
| Buanderie Blanchelle | October 15, 2025 | ransomware_live | — |
| Superior Linen Service | October 15, 2025 | ransomware_live | — |
| Turnkey Africa | October 15, 2025 | ransomware_live | — |
| Centurion Family Office Services LLC | October 15, 2025 | ransomware_live | — |
| Richmond Behavioral Health Authority | October 15, 2025 | ransomware_live | — |
| Agencia Tributaria | October 15, 2025 | ransomware_live | — |
| Rasi Laboratories | October 15, 2025 | ransomware_live | — |
| Sprague & Jackson | October 15, 2025 | ransomware_live | — |
| Middlesex Appraisal Associates | October 15, 2025 | ransomware_live | — |
| Bengal Industries | October 15, 2025 | ransomware_live | — |
| M&E Global Group | October 14, 2025 | ransomware_live | — |
| DV Hardwoods | October 14, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).