qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Force Marketing | October 14, 2025 | ransomware_live | — |
| Repeated Signal Solutions | October 14, 2025 | ransomware_live | — |
| Club Lleuresport | October 14, 2025 | ransomware_live | — |
| Tong Yang Group | October 14, 2025 | ransomware_live | — |
| Radiant Beauty Supplies | October 14, 2025 | ransomware_live | — |
| Clifford Paper | October 14, 2025 | ransomware_live | — |
| H. Gascon | October 14, 2025 | ransomware_live | — |
| Polar-studio | October 14, 2025 | ransomware_live | — |
| Capitol Construction Services | October 14, 2025 | ransomware_live | — |
| Morris-Sockle | October 14, 2025 | ransomware_live | — |
| HMP Global | October 14, 2025 | ransomware_live | — |
| Catawba County Government | October 14, 2025 | ransomware_live | — |
| American Journal of Managed Care | October 14, 2025 | ransomware_live | — |
| Typology | October 14, 2025 | ransomware_live | — |
| LaRosa's | October 14, 2025 | ransomware_live | — |
| Ditransa | October 14, 2025 | ransomware_live | — |
| Addis | October 14, 2025 | ransomware_live | — |
| Trans-World Shipping Service | October 14, 2025 | ransomware_live | — |
| Gittens Healthcare | October 14, 2025 | ransomware_live | — |
| City of Riviera Beach, Florida | October 14, 2025 | ransomware_live | — |
| Buldi | October 14, 2025 | ransomware_live | — |
| Paris Rétina Vision | October 14, 2025 | ransomware_live | — |
| UT Health Austin | October 14, 2025 | ransomware_live | — |
| PQCNC Hospitals | October 14, 2025 | ransomware_live | — |
| EURORDIS | October 14, 2025 | ransomware_live | — |
| SICE | October 14, 2025 | ransomware_live | — |
| Alqueria | October 14, 2025 | ransomware_live | — |
| Urban Linker | October 14, 2025 | ransomware_live | — |
| Hunter Construction Group | October 14, 2025 | ransomware_live | — |
| Roger RENARD Entreprise | October 14, 2025 | ransomware_live | — |
| Home/ Schramm Udo Dipl Kfm Steuerberater | October 14, 2025 | ransomware_live | — |
| Alu Perpignan | October 14, 2025 | ransomware_live | — |
| Executive Cabinetry | October 14, 2025 | ransomware_live | — |
| Prim Saveurs Import Export | October 14, 2025 | ransomware_live | — |
| Canapés Mobilier Décoration | October 14, 2025 | ransomware_live | — |
| Pro-Fab | October 14, 2025 | ransomware_live | — |
| Volkswagen Group France | October 14, 2025 | ransomware_live | — |
| WebCut Converting | October 14, 2025 | ransomware_live | — |
| SFG Technology Sdn Bhd | October 14, 2025 | ransomware_live | — |
| New Jersey Property-Liability Insurance Guaranty Association | October 14, 2025 | ransomware_live | — |
| Charles River Properties | October 14, 2025 | ransomware_live | — |
| Suarez & Menendez | October 14, 2025 | ransomware_live | — |
| hautsdefrance.fr | October 13, 2025 | ransomware_live | — |
| SourceOne Corporation | October 13, 2025 | ransomware_live | — |
| BHI Co., Ltd. | October 13, 2025 | ransomware_live | — |
| San Bernard Electric Cooperative | October 13, 2025 | ransomware_live | — |
| Bank3 | October 13, 2025 | ransomware_live | — |
| Dynamic Precision Sverige | October 12, 2025 | ransomware_live | — |
| DuVal & Associates | October 11, 2025 | ransomware_live | — |
| Greenstar Social Marketing | October 11, 2025 | ransomware_live | — |
| Atarfil | October 11, 2025 | ransomware_live | — |
| grupocaparros.com | October 10, 2025 | ransomware_live | — |
| Artan Holding | October 10, 2025 | ransomware_live | — |
| Karnes Electric Cooperative | October 10, 2025 | ransomware_live | — |
| bmcinnovation.com | October 10, 2025 | ransomware_live | — |
| alissco.com | October 10, 2025 | ransomware_live | — |
| MBS Secure | October 9, 2025 | ransomware_live | — |
| Midsun Group | October 9, 2025 | ransomware_live | — |
| Spectra Logic+DATA | October 8, 2025 | ransomware_live | — |
| Valley Eye Associates | October 8, 2025 | ransomware_live | — |
| Massachusetts Bay Community College | October 7, 2025 | ransomware_live | — |
| Asahi Group Holdings, Ltd. | October 7, 2025 | ransomware_live | — |
| cameronhodges.com | October 7, 2025 | ransomware_live | — |
| Alef Realty, LLC | October 7, 2025 | ransomware_live | — |
| Lipapromet | October 6, 2025 | ransomware_live | — |
| ville-saintclaude.fr | October 6, 2025 | ransomware_live | — |
| California Golf Club of San Francisco | October 5, 2025 | ransomware_live | — |
| AIP Asset Management | October 4, 2025 | ransomware_live | — |
| kanzlei-schramm.com | October 4, 2025 | ransomware_live | — |
| IONODES | October 3, 2025 | ransomware_live | — |
| Corban OneSource | October 3, 2025 | ransomware_live | — |
| Rihatec.de | October 3, 2025 | ransomware_live | — |
| Rihatec Systemlösungen | October 3, 2025 | ransomware_live | — |
| Beta Dyne | October 3, 2025 | ransomware_live | — |
| Shamir Medical Center | October 2, 2025 | ransomware_live | — |
| South Alabama Regional Planning Commission | October 2, 2025 | ransomware_live | — |
| Mobidic Asset Management | September 30, 2025 | ransomware_live | — |
| Foremost Asset Management | September 30, 2025 | ransomware_live | — |
| www.auto-bernhard.at | September 30, 2025 | ransomware_live | — |
| Price & Ramey Insurance | September 30, 2025 | ransomware_live | — |
| Mecklenburg County Public Schools | September 29, 2025 | ransomware_live | — |
| PTR Asset Management | September 28, 2025 | ransomware_live | — |
| Yooshin Engineering Corporation | September 26, 2025 | ransomware_live | — |
| sperispa.com | September 25, 2025 | ransomware_live | — |
| waxhaw.com | September 25, 2025 | ransomware_live | — |
| Trustar Capital Management Co | September 25, 2025 | ransomware_live | — |
| HUB ASSET MANAGEMENT Co | September 25, 2025 | ransomware_live | — |
| WEST Inc. | September 25, 2025 | ransomware_live | — |
| Pangea Travel Store | September 25, 2025 | ransomware_live | — |
| kecymetals.com | September 24, 2025 | ransomware_live | — |
| Kecy Metal Technologies | September 24, 2025 | ransomware_live | — |
| www.chinup.com.tw | September 23, 2025 | ransomware_live | — |
| www.cr-installers.com | September 23, 2025 | ransomware_live | — |
| www.apm-finance.de | September 23, 2025 | ransomware_live | — |
| NV ELMAR | September 20, 2025 | ransomware_live | — |
| cegconstruction.com | September 20, 2025 | ransomware_live | — |
| Promociones Luis Barros | September 19, 2025 | ransomware_live | — |
| www.landmarkmgtinc.com | September 19, 2025 | ransomware_live | — |
| Landmark Management | September 19, 2025 | ransomware_live | — |
| Dblock Asset Management Co | September 18, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).