qilin
First seen October 8, 2022Active2,414 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.monaghan.eu | January 30, 2025 | ransomware_live | — |
| Versalys.com | January 29, 2025 | ransomware_live | — |
| RDC Architects | January 27, 2025 | ransomware_live | — |
| ctpomd | January 26, 2025 | ransomware_live | — |
| World Wide Fittings | January 26, 2025 | ransomware_live | — |
| SPEEDFAM | January 26, 2025 | ransomware_live | — |
| The Gatesworth Senior Living St. Louis | January 24, 2025 | ransomware_live | — |
| DPA Auctions | January 24, 2025 | ransomware_live | — |
| liftsolutionsinc.net | January 23, 2025 | ransomware_live | — |
| Rabwin | January 20, 2025 | ransomware_live | — |
| HIKARI SEIKO | January 18, 2025 | ransomware_live | — |
| boginmunns.com | January 15, 2025 | ransomware_live | — |
| wieso-cert | January 15, 2025 | ransomware_live | — |
| Erie Management Group, LLC | January 14, 2025 | ransomware_live | — |
| Thilges & Bernhardt, Attorneys at Law | January 12, 2025 | ransomware_live | — |
| Wannemacher Enterprises Inc | January 12, 2025 | ransomware_live | — |
| Galvatech | January 12, 2025 | ransomware_live | — |
| pleasantsconstruction.com | January 11, 2025 | ransomware_live | — |
| Black Hills Regional Eye Institute | January 8, 2025 | ransomware_live | — |
| JKC Australia LNG | January 8, 2025 | ransomware_live | — |
| Bulverde Glass, Inc. | January 3, 2025 | ransomware_live | — |
| McCORMICK TAYLOR | December 29, 2024 | ransomware_live | — |
| Andover Family Medicine | December 29, 2024 | ransomware_live | — |
| Refreshment Services Pepsi | December 26, 2024 | ransomware_live | — |
| cityofwesthaven.com | December 25, 2024 | ransomware_live | — |
| amourgis.com | December 25, 2024 | ransomware_live | — |
| Wertex Group | December 25, 2024 | ransomware_live | — |
| Helitek Company Ltd. | December 25, 2024 | ransomware_live | — |
| Clnica CES | December 23, 2024 | ransomware_live | — |
| Hewsco.com | December 22, 2024 | ransomware_live | — |
| www.clubcar.com | December 22, 2024 | ransomware_live | — |
| Access2Jobs | December 20, 2024 | ransomware_live | — |
| akran | December 19, 2024 | ransomware_live | — |
| Compliance Solutions Inc | December 17, 2024 | ransomware_live | — |
| lscd | December 16, 2024 | ransomware_live | — |
| HEXPOL COMPOUNDING AMERICAS | December 15, 2024 | ransomware_live | — |
| acm | December 15, 2024 | ransomware_live | — |
| favbet | December 13, 2024 | ransomware_live | — |
| Bianco Brain & Spine | December 11, 2024 | ransomware_live | — |
| Primary Plus | December 11, 2024 | ransomware_live | — |
| YorkTest Laboratories | December 10, 2024 | ransomware_live | — |
| TJKM | December 7, 2024 | ransomware_live | — |
| Spring Creek Golf & Country Club | December 7, 2024 | ransomware_live | — |
| Spectrum Solutions | December 5, 2024 | ransomware_live | — |
| Cambridge Fluid Systems | December 5, 2024 | ransomware_live | — |
| Marine Stores Guide | December 3, 2024 | ransomware_live | — |
| Billaud Segeba | December 2, 2024 | ransomware_live | — |
| Veccio and Company PLLC | December 2, 2024 | ransomware_live | — |
| AC Technical Systems | November 27, 2024 | ransomware_live | — |
| North Platte Natural Resources District | November 27, 2024 | ransomware_live | — |
| EQ Chartered Accountants | November 26, 2024 | ransomware_live | — |
| WELKER | World-Class Manufacturing | November 26, 2024 | ransomware_live | — |
| F.TECH R&D NORTH AMERICA INC. | November 26, 2024 | ransomware_live | — |
| The Good Samaritan Health Center of Cobb | November 25, 2024 | ransomware_live | — |
| Zimmerman & Frachtman PA Law Firm | November 22, 2024 | ransomware_live | — |
| Calvert Home Mortgage Investment | November 22, 2024 | ransomware_live | — |
| LBCO Contracting LTD | November 22, 2024 | ransomware_live | — |
| Billaud | November 22, 2024 | ransomware_live | — |
| Flamco | November 21, 2024 | ransomware_live | — |
| SUSTA-STAMPI | November 18, 2024 | ransomware_live | — |
| Super Vac | November 17, 2024 | ransomware_live | — |
| Privat Spitex | November 15, 2024 | ransomware_live | — |
| Privat-Spitex Schweiz GmbH | November 15, 2024 | ransomware_live | — |
| chaves | November 13, 2024 | ransomware_live | — |
| Town of Whitestown - NY Highway Department | November 9, 2024 | ransomware_live | — |
| USE Federal Credit Union | November 9, 2024 | ransomware_live | — |
| Prime Group US | November 7, 2024 | ransomware_live | — |
| Berman Law Group | November 7, 2024 | ransomware_live | — |
| Alpha Care Medical Group | November 6, 2024 | ransomware_live | — |
| Browne McGregor Architects | November 6, 2024 | ransomware_live | — |
| Red Phoenix Construction | November 4, 2024 | ransomware_live | — |
| Sasszemklinika | November 1, 2024 | ransomware_live | — |
| Imprimerie Peau | October 28, 2024 | ransomware_live | — |
| DieTech North America | October 27, 2024 | ransomware_live | — |
| PetroSouth | October 25, 2024 | ransomware_live | — |
| aziz oil | October 25, 2024 | ransomware_live | — |
| Freyberg Petroleum | October 25, 2024 | ransomware_live | — |
| AIMS, Inc. Fuel Business Accounting Software, Jobber Software Wholesale Petroleum Acco | October 25, 2024 | ransomware_live | — |
| IDN | October 25, 2024 | ransomware_live | — |
| LaMear & Rapert, LLC - Accounting Firm | October 23, 2024 | ransomware_live | — |
| St Edmund's College | October 22, 2024 | ransomware_live | — |
| Dinaksa Pesaje | October 22, 2024 | ransomware_live | — |
| Groupe Althays | October 20, 2024 | ransomware_live | — |
| patria.hu | October 19, 2024 | ransomware_live | — |
| Aiken Electric Cooperative | October 19, 2024 | ransomware_live | — |
| Groupe PPA- Mahe | October 18, 2024 | ransomware_live | — |
| Hronopoulos | October 18, 2024 | ransomware_live | — |
| www.smawins.com | October 18, 2024 | ransomware_live | — |
| Flo Components | October 14, 2024 | ransomware_live | — |
| Dalincoln | October 9, 2024 | ransomware_live | — |
| ebrso | October 8, 2024 | ransomware_live | — |
| maxvaluecredits.com | October 5, 2024 | ransomware_live | — |
| tanyacreations.com | October 4, 2024 | ransomware_live | — |
| Kleber and Associates | October 4, 2024 | ransomware_live | — |
| www.mltmua.com | October 3, 2024 | ransomware_live | — |
| www.globelink.com.au | October 3, 2024 | ransomware_live | — |
| Forshey Prostok LLP | October 2, 2024 | ransomware_live | — |
| performance-therapies | October 1, 2024 | ransomware_live | — |
| McAbee Construction, Inc | September 30, 2024 | ransomware_live | — |
| Keller Williams Realty Group | September 30, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).