qilin
First seen October 8, 2022Active2,414 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Dblock Asset Management Co | September 18, 2025 | ransomware_live | — |
| Orum Asset management | September 18, 2025 | ransomware_live | — |
| ST Asset Management Co | September 18, 2025 | ransomware_live | — |
| EOS Asset management | September 18, 2025 | ransomware_live | — |
| Broad High Asset Management | September 18, 2025 | ransomware_live | — |
| EUM Asset Management | September 18, 2025 | ransomware_live | — |
| Mitrani Rynor Adamsky & Toland | September 18, 2025 | ransomware_live | — |
| sagchip.org | September 18, 2025 | ransomware_live | — |
| mcgeorgeai.com | September 18, 2025 | ransomware_live | — |
| McGeorge Architecture Interiors | September 18, 2025 | ransomware_live | — |
| Prime Asset Fund | September 17, 2025 | ransomware_live | — |
| spartanburgcounty | September 17, 2025 | ransomware_live | — |
| Zebra Asset Management Co | September 17, 2025 | ransomware_live | — |
| Saebom Asset Management | September 17, 2025 | ransomware_live | — |
| SUNIQUE Asset Management Co | September 17, 2025 | ransomware_live | — |
| XCAssociates | September 17, 2025 | ransomware_live | — |
| Office Of The Registrar Of Political Parties | September 14, 2025 | ransomware_live | — |
| LX Asset Management | September 14, 2025 | ransomware_live | — |
| Taurus Investment & Securities Co | September 14, 2025 | ransomware_live | — |
| Melon Asset Management Co. | September 14, 2025 | ransomware_live | — |
| Majesty Asset Management Co. | September 14, 2025 | ransomware_live | — |
| APEX Asset Management | September 14, 2025 | ransomware_live | — |
| VANCHOR Asset Management | September 14, 2025 | ransomware_live | — |
| Awesome Asset Management Co | September 14, 2025 | ransomware_live | — |
| Human and Bridge Asset Management | September 14, 2025 | ransomware_live | — |
| Klarman Asset Management | September 14, 2025 | ransomware_live | — |
| opso.us | September 13, 2025 | ransomware_live | — |
| [Redacted] #1510 | September 13, 2025 | ransomware_live | — |
| trchealthcare.com | September 13, 2025 | ransomware_live | — |
| smpeurope.com | September 12, 2025 | ransomware_live | — |
| www.ucisd.net | September 12, 2025 | ransomware_live | — |
| Frisquet | September 12, 2025 | ransomware_live | — |
| TAKwest | September 11, 2025 | ransomware_live | — |
| Pieffe Auto Group | September 11, 2025 | ransomware_live | — |
| Spectra Logic | September 10, 2025 | ransomware_live | — |
| Wouters France | September 9, 2025 | ransomware_live | — |
| Eagle Excavation | September 9, 2025 | ransomware_live | — |
| Rectory School | September 9, 2025 | ransomware_live | — |
| EPLS: Entreprise d'Installations électriques Courant Fort | September 8, 2025 | ransomware_live | — |
| Plan B Die Fachanwaltskanzlei | September 8, 2025 | ransomware_live | — |
| runaces.com | September 7, 2025 | ransomware_live | — |
| Petraville Asset Management | September 7, 2025 | ransomware_live | — |
| Mechatronics | September 6, 2025 | ransomware_live | — |
| Pollex Asset Management Co. | September 6, 2025 | ransomware_live | — |
| grupobocel.com | September 6, 2025 | ransomware_live | — |
| oconnorcp.com | September 6, 2025 | ransomware_live | — |
| heparks.org | September 6, 2025 | ransomware_live | — |
| www.vdyne.com | September 5, 2025 | ransomware_live | — |
| Team Schierl Companies | September 5, 2025 | ransomware_live | — |
| regalmold.com | September 4, 2025 | ransomware_live | — |
| BCR Recouvrement | September 4, 2025 | ransomware_live | — |
| Sistema Odontológico Privado | September 4, 2025 | ransomware_live | — |
| NPIAV | September 3, 2025 | ransomware_live | — |
| blytheco.com | September 3, 2025 | ransomware_live | — |
| musimmas.com | September 3, 2025 | ransomware_live | — |
| Master System Inc | September 3, 2025 | ransomware_live | — |
| flamgard.co.uk | September 3, 2025 | ransomware_live | — |
| identic.be | September 2, 2025 | ransomware_live | — |
| PathoQuest-Biotechnology Research | September 1, 2025 | ransomware_live | — |
| ESIC_TR | August 30, 2025 | ransomware_live | — |
| Tecnología Especializada Asociada de México | August 30, 2025 | ransomware_live | — |
| L&S Proline | August 30, 2025 | ransomware_live | — |
| Rivertown Surgey Center | August 30, 2025 | ransomware_live | — |
| atlanta neighborhood charter school | August 29, 2025 | ransomware_live | — |
| Ekotrade | August 29, 2025 | ransomware_live | — |
| gmcontractinginc.com | August 28, 2025 | ransomware_live | — |
| Town of Chatham, MASSACHUSETTS | August 28, 2025 | ransomware_live | — |
| ogdenpubs.com | August 28, 2025 | ransomware_live | — |
| ibew1547.org | August 28, 2025 | ransomware_live | — |
| allphaselandscape.net | August 28, 2025 | ransomware_live | — |
| Ekmanian Tax & Accounting | August 28, 2025 | ransomware_live | — |
| www.mpmimports.com.cy | August 28, 2025 | ransomware_live | — |
| www.officepro.cl | August 28, 2025 | ransomware_live | — |
| MPM Imports | August 28, 2025 | ransomware_live | — |
| Weathercraft Companies | August 27, 2025 | ransomware_live | — |
| camaradealmeria.com | August 27, 2025 | ransomware_live | — |
| lakehaven.org | August 27, 2025 | ransomware_live | — |
| singersf.com | August 26, 2025 | ransomware_live | — |
| nrlassoc.com | August 25, 2025 | ransomware_live | — |
| hydrometrics.com | August 25, 2025 | ransomware_live | — |
| gibbswire.com | August 25, 2025 | ransomware_live | — |
| Osaki Medical | August 24, 2025 | ransomware_live | — |
| www.ecodemolizionisrl.com | August 22, 2025 | ransomware_live | — |
| denali-industrial.com | August 22, 2025 | ransomware_live | — |
| halemakua.org | August 22, 2025 | ransomware_live | — |
| thomasmhughes.com | August 22, 2025 | ransomware_live | — |
| www.gillette-ac.com | August 21, 2025 | ransomware_live | — |
| www.greneker.com | August 21, 2025 | ransomware_live | — |
| uhlcompany.com | August 21, 2025 | ransomware_live | — |
| idscorporation.com | August 20, 2025 | ransomware_live | — |
| garnertrucking.com | August 20, 2025 | ransomware_live | — |
| netfusionconsulting.com | August 20, 2025 | ransomware_live | — |
| insoca.es | August 20, 2025 | ransomware_live | — |
| lee-irvine.com | August 20, 2025 | ransomware_live | — |
| DAOR E&C Co., Ltd | August 20, 2025 | ransomware_live | — |
| welldone.com.tw | August 20, 2025 | ransomware_live | — |
| Fullerton Surgical Center (FSC) | August 20, 2025 | ransomware_live | — |
| Nissan CBI | August 20, 2025 | ransomware_live | — |
| medosweet.com | August 20, 2025 | ransomware_live | — |
| seabridge.eu+efico.com | August 19, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).