qilin
First seen October 8, 2022Active2,262 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| F.TECH R&D NORTH AMERICA INC. | November 26, 2024 | ransomware_live | — |
| The Good Samaritan Health Center of Cobb | November 25, 2024 | ransomware_live | — |
| Zimmerman & Frachtman PA Law Firm | November 22, 2024 | ransomware_live | — |
| Calvert Home Mortgage Investment | November 22, 2024 | ransomware_live | — |
| LBCO Contracting LTD | November 22, 2024 | ransomware_live | — |
| Billaud | November 22, 2024 | ransomware_live | — |
| Flamco | November 21, 2024 | ransomware_live | — |
| SUSTA-STAMPI | November 18, 2024 | ransomware_live | — |
| Super Vac | November 17, 2024 | ransomware_live | — |
| Privat Spitex | November 15, 2024 | ransomware_live | — |
| Privat-Spitex Schweiz GmbH | November 15, 2024 | ransomware_live | — |
| chaves | November 13, 2024 | ransomware_live | — |
| Town of Whitestown - NY Highway Department | November 9, 2024 | ransomware_live | — |
| USE Federal Credit Union | November 9, 2024 | ransomware_live | — |
| Prime Group US | November 7, 2024 | ransomware_live | — |
| Berman Law Group | November 7, 2024 | ransomware_live | — |
| Alpha Care Medical Group | November 6, 2024 | ransomware_live | — |
| Browne McGregor Architects | November 6, 2024 | ransomware_live | — |
| Red Phoenix Construction | November 4, 2024 | ransomware_live | — |
| Sasszemklinika | November 1, 2024 | ransomware_live | — |
| Imprimerie Peau | October 28, 2024 | ransomware_live | — |
| DieTech North America | October 27, 2024 | ransomware_live | — |
| PetroSouth | October 25, 2024 | ransomware_live | — |
| aziz oil | October 25, 2024 | ransomware_live | — |
| Freyberg Petroleum | October 25, 2024 | ransomware_live | — |
| AIMS, Inc. Fuel Business Accounting Software, Jobber Software Wholesale Petroleum Acco | October 25, 2024 | ransomware_live | — |
| IDN | October 25, 2024 | ransomware_live | — |
| LaMear & Rapert, LLC - Accounting Firm | October 23, 2024 | ransomware_live | — |
| St Edmund's College | October 22, 2024 | ransomware_live | — |
| Dinaksa Pesaje | October 22, 2024 | ransomware_live | — |
| Groupe Althays | October 20, 2024 | ransomware_live | — |
| patria.hu | October 19, 2024 | ransomware_live | — |
| Aiken Electric Cooperative | October 19, 2024 | ransomware_live | — |
| Groupe PPA- Mahe | October 18, 2024 | ransomware_live | — |
| Hronopoulos | October 18, 2024 | ransomware_live | — |
| www.smawins.com | October 18, 2024 | ransomware_live | — |
| Flo Components | October 14, 2024 | ransomware_live | — |
| Dalincoln | October 9, 2024 | ransomware_live | — |
| ebrso | October 8, 2024 | ransomware_live | — |
| maxvaluecredits.com | October 5, 2024 | ransomware_live | — |
| tanyacreations.com | October 4, 2024 | ransomware_live | — |
| Kleber and Associates | October 4, 2024 | ransomware_live | — |
| www.mltmua.com | October 3, 2024 | ransomware_live | — |
| www.globelink.com.au | October 3, 2024 | ransomware_live | — |
| Forshey Prostok LLP | October 2, 2024 | ransomware_live | — |
| performance-therapies | October 1, 2024 | ransomware_live | — |
| McAbee Construction, Inc | September 30, 2024 | ransomware_live | — |
| Keller Williams Realty Group | September 30, 2024 | ransomware_live | — |
| canstarrestorations.com | September 30, 2024 | ransomware_live | — |
| DMF Lighting | September 30, 2024 | ransomware_live | — |
| Richardson | September 30, 2024 | ransomware_live | — |
| klingler-installationen-gmbh | September 28, 2024 | ransomware_live | — |
| Valu-Trac Investment Management | September 27, 2024 | ransomware_live | — |
| DPC DATA | September 26, 2024 | ransomware_live | — |
| Heritage Golf | September 25, 2024 | ransomware_live | — |
| DAIKIN THAILAND | September 25, 2024 | ransomware_live | — |
| The Law Offices of Jed Silverman | September 24, 2024 | ransomware_live | — |
| Canstar Restorations | September 23, 2024 | ransomware_live | — |
| Detroit Public TV | September 23, 2024 | ransomware_live | — |
| Kravit, Hovel & Krawczyk SC | September 23, 2024 | ransomware_live | — |
| DETROIT PBS ( PUBLIC TV ) | September 23, 2024 | ransomware_live | — |
| McGaughey & Keaney CPAs | September 23, 2024 | ransomware_live | — |
| Woodard , Hernandez , Roth & Day | September 22, 2024 | ransomware_live | — |
| AXIOM | September 22, 2024 | ransomware_live | — |
| MHT Partners | September 19, 2024 | ransomware_live | — |
| propak | September 16, 2024 | ransomware_live | — |
| United Animal Health | September 13, 2024 | ransomware_live | — |
| www.ekirkpatrick.com | September 12, 2024 | ransomware_live | — |
| Bertelkamp Automation | September 11, 2024 | ransomware_live | — |
| American Air Conditioning & Heating | September 9, 2024 | ransomware_live | — |
| CAM Tyre Trade Systems & Solutions | September 8, 2024 | ransomware_live | — |
| Millsboro Animal Hospital | September 7, 2024 | ransomware_live | — |
| Kingsmill Resort | August 31, 2024 | ransomware_live | — |
| KW Realty Group | August 31, 2024 | ransomware_live | — |
| Arch Street Capital Advisors | August 30, 2024 | ransomware_live | — |
| Stiller Aesthetics | August 29, 2024 | ransomware_live | — |
| Risser Oil | August 29, 2024 | ransomware_live | — |
| DIamond Contracting, LLC | August 29, 2024 | ransomware_live | — |
| Brookshire Dental - Hospitals & Clinics | August 26, 2024 | ransomware_live | — |
| dt-technologies | August 25, 2024 | ransomware_live | — |
| Stalcop Metal Forming LLC | August 25, 2024 | ransomware_live | — |
| JM Thompson | August 24, 2024 | ransomware_live | — |
| Baucenter.it | August 24, 2024 | ransomware_live | — |
| kahle cpa | August 23, 2024 | ransomware_live | — |
| Phoenix Air Conditioning & Heating | August 22, 2024 | ransomware_live | — |
| Mason City Recycling Center | August 19, 2024 | ransomware_live | — |
| agricola | August 19, 2024 | ransomware_live | — |
| Blink Photo | August 19, 2024 | ransomware_live | — |
| Penn Veterinary Supply INC | August 14, 2024 | ransomware_live | — |
| Exitz Technologies | August 14, 2024 | ransomware_live | — |
| EAGLE School | August 13, 2024 | ransomware_live | — |
| Brookshire Dental | August 12, 2024 | ransomware_live | — |
| Luso Cuanzа | August 11, 2024 | ransomware_live | — |
| Amco Metal Industrial Corporation | August 6, 2024 | ransomware_live | — |
| Dhoot Transmission | August 5, 2024 | ransomware_live | — |
| New TSI Holdings, NYSC | July 29, 2024 | ransomware_live | — |
| Patterson Health Center | July 26, 2024 | ransomware_live | — |
| Turman | July 26, 2024 | ransomware_live | — |
| Hiesmayr Haustechnik | July 25, 2024 | ransomware_live | — |
| simple-solution-systems | July 24, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).