qilin
First seen October 8, 2022Active2,262 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sistema Odontológico Privado | September 4, 2025 | ransomware_live | — |
| NPIAV | September 3, 2025 | ransomware_live | — |
| blytheco.com | September 3, 2025 | ransomware_live | — |
| musimmas.com | September 3, 2025 | ransomware_live | — |
| Master System Inc | September 3, 2025 | ransomware_live | — |
| flamgard.co.uk | September 3, 2025 | ransomware_live | — |
| identic.be | September 2, 2025 | ransomware_live | — |
| PathoQuest-Biotechnology Research | September 1, 2025 | ransomware_live | — |
| ESIC_TR | August 30, 2025 | ransomware_live | — |
| Tecnología Especializada Asociada de México | August 30, 2025 | ransomware_live | — |
| L&S Proline | August 30, 2025 | ransomware_live | — |
| Rivertown Surgey Center | August 30, 2025 | ransomware_live | — |
| atlanta neighborhood charter school | August 29, 2025 | ransomware_live | — |
| Ekotrade | August 29, 2025 | ransomware_live | — |
| gmcontractinginc.com | August 28, 2025 | ransomware_live | — |
| Town of Chatham, MASSACHUSETTS | August 28, 2025 | ransomware_live | — |
| ogdenpubs.com | August 28, 2025 | ransomware_live | — |
| ibew1547.org | August 28, 2025 | ransomware_live | — |
| allphaselandscape.net | August 28, 2025 | ransomware_live | — |
| Ekmanian Tax & Accounting | August 28, 2025 | ransomware_live | — |
| www.mpmimports.com.cy | August 28, 2025 | ransomware_live | — |
| www.officepro.cl | August 28, 2025 | ransomware_live | — |
| MPM Imports | August 28, 2025 | ransomware_live | — |
| Weathercraft Companies | August 27, 2025 | ransomware_live | — |
| camaradealmeria.com | August 27, 2025 | ransomware_live | — |
| lakehaven.org | August 27, 2025 | ransomware_live | — |
| singersf.com | August 26, 2025 | ransomware_live | — |
| nrlassoc.com | August 25, 2025 | ransomware_live | — |
| hydrometrics.com | August 25, 2025 | ransomware_live | — |
| gibbswire.com | August 25, 2025 | ransomware_live | — |
| Osaki Medical | August 24, 2025 | ransomware_live | — |
| www.ecodemolizionisrl.com | August 22, 2025 | ransomware_live | — |
| denali-industrial.com | August 22, 2025 | ransomware_live | — |
| halemakua.org | August 22, 2025 | ransomware_live | — |
| thomasmhughes.com | August 22, 2025 | ransomware_live | — |
| www.gillette-ac.com | August 21, 2025 | ransomware_live | — |
| www.greneker.com | August 21, 2025 | ransomware_live | — |
| uhlcompany.com | August 21, 2025 | ransomware_live | — |
| idscorporation.com | August 20, 2025 | ransomware_live | — |
| garnertrucking.com | August 20, 2025 | ransomware_live | — |
| netfusionconsulting.com | August 20, 2025 | ransomware_live | — |
| insoca.es | August 20, 2025 | ransomware_live | — |
| lee-irvine.com | August 20, 2025 | ransomware_live | — |
| DAOR E&C Co., Ltd | August 20, 2025 | ransomware_live | — |
| welldone.com.tw | August 20, 2025 | ransomware_live | — |
| Fullerton Surgical Center (FSC) | August 20, 2025 | ransomware_live | — |
| Nissan CBI | August 20, 2025 | ransomware_live | — |
| medosweet.com | August 20, 2025 | ransomware_live | — |
| seabridge.eu+efico.com | August 19, 2025 | ransomware_live | — |
| All Truck Transportation Co., Inc. | August 19, 2025 | ransomware_live | — |
| All Truck Transportation | August 19, 2025 | ransomware_live | — |
| swanforlife.com | August 18, 2025 | ransomware_live | — |
| diversifiedcpc.com | August 18, 2025 | ransomware_live | — |
| Welcome Financial Group | August 17, 2025 | ransomware_live | — |
| Graphite Construction Group | August 17, 2025 | ransomware_live | — |
| Xperthair | August 16, 2025 | ransomware_live | — |
| Morgenstern AG | August 15, 2025 | ransomware_live | — |
| marma.com.pl | August 15, 2025 | ransomware_live | — |
| volinc.com | August 14, 2025 | ransomware_live | — |
| ffs.com | August 13, 2025 | ransomware_live | — |
| smefazur.fr | August 13, 2025 | ransomware_live | — |
| ethicalpackaging.co.uk | August 13, 2025 | ransomware_live | — |
| Assisted Living Pharmacy Service LLC | August 12, 2025 | ransomware_live | — |
| Haeger & Schmidt Logistics | August 12, 2025 | ransomware_live | — |
| northernconstruction.com | August 12, 2025 | ransomware_live | — |
| bvasd.net | August 12, 2025 | ransomware_live | — |
| Ahtna Incorporated | August 12, 2025 | ransomware_live | — |
| Uganda Electricity Transmission Company Limited | August 12, 2025 | ransomware_live | — |
| www.wyongleagues.com.au | August 12, 2025 | ransomware_live | — |
| empur | August 11, 2025 | ransomware_live | — |
| burmann.de | August 11, 2025 | ransomware_live | — |
| Charak Center for Health | August 11, 2025 | ransomware_live | — |
| liabergamo.it | August 11, 2025 | ransomware_live | — |
| Inotiv, Inc | August 11, 2025 | ransomware_live | — |
| Spohn + Burkhardt GmbH & Co KG | August 9, 2025 | ransomware_live | — |
| getech.com | August 8, 2025 | ransomware_live | — |
| lodipd.org | August 7, 2025 | ransomware_live | — |
| camdon.ca | August 7, 2025 | ransomware_live | — |
| avosinamed.com | August 7, 2025 | ransomware_live | — |
| eyeqmonitoring.com | August 7, 2025 | ransomware_live | — |
| lpco.co | August 7, 2025 | ransomware_live | — |
| Belmont christian college | August 7, 2025 | ransomware_live | — |
| CIMEXSTEEL.CZ | August 7, 2025 | ransomware_live | — |
| Çağrı Group | August 7, 2025 | ransomware_live | — |
| ferrocortes | August 6, 2025 | ransomware_live | — |
| Clifford Paper Inc | August 5, 2025 | ransomware_live | — |
| easternadjustment.com | August 4, 2025 | ransomware_live | — |
| haaker.com | August 4, 2025 | ransomware_live | — |
| Aggressive Air Compressor & co | August 3, 2025 | ransomware_live | — |
| brebeuf.org | August 3, 2025 | ransomware_live | — |
| fortsmithschools.org | August 1, 2025 | ransomware_live | — |
| envac.es | August 1, 2025 | ransomware_live | — |
| cadex.com | August 1, 2025 | ransomware_live | — |
| ZEF | August 1, 2025 | ransomware_live | — |
| ZEF's | August 1, 2025 | ransomware_live | — |
| csrepair.com | July 31, 2025 | ransomware_live | — |
| syncadd.com | July 31, 2025 | ransomware_live | — |
| www.afmco.jo | July 30, 2025 | ransomware_live | — |
| tissot.com | July 29, 2025 | ransomware_live | — |
| azurewave.com | July 29, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).