qilin
First seen October 8, 2022Active2,406 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Black Cat Engineering & Construction WLL | August 23, 2026 | ransomware_live | — |
| Difor | August 23, 2026 | ransomware_live | — |
| Clear Align | August 23, 2026 | ransomware_live | — |
| Aurore Development S.p.A. | August 23, 2026 | ransomware_live | — |
| Studio BOLDRIN PAOLO | August 23, 2026 | ransomware_live | — |
| Tecnici Associati STP | August 23, 2026 | ransomware_live | — |
| Euroflora srl | August 23, 2026 | ransomware_live | — |
| S.E.M.P. s.r.l. | August 23, 2026 | ransomware_live | — |
| Professional | August 21, 2026 | ransomware_live | — |
| Blake Services | August 21, 2026 | ransomware_live | — |
| The Pendas Law Firm | August 21, 2026 | ransomware_live | — |
| Gindre India | August 21, 2026 | ransomware_live | — |
| Cinépolis | August 21, 2026 | ransomware_live | — |
| iPic | August 21, 2026 | ransomware_live | — |
| Quaker State Mexico | August 21, 2026 | ransomware_live | — |
| Trends And Concepts | August 20, 2026 | ransomware_live | — |
| Provite | August 20, 2026 | ransomware_live | — |
| Questronix | August 20, 2026 | ransomware_live | — |
| Integraduanas | August 19, 2026 | ransomware_live | — |
| Smart Energies | August 19, 2026 | ransomware_live | — |
| Medochemie | August 19, 2026 | ransomware_live | — |
| Philippe Hottinguer Finance | August 19, 2026 | ransomware_live | — |
| InVentry | August 19, 2026 | ransomware_live | — |
| WIS LOGISTICS | August 19, 2026 | ransomware_live | — |
| Movitecnica | August 19, 2026 | ransomware_live | — |
| Constructora Jimenez | August 19, 2026 | ransomware_live | — |
| Estech | August 19, 2026 | ransomware_live | — |
| Thrifty Building Supply | August 19, 2026 | ransomware_live | — |
| Semana | August 19, 2026 | ransomware_live | — |
| Berlin Brandenburgische Wohnungsbaugenossenschaft | August 18, 2026 | ransomware_live | — |
| EmpireWorks | August 17, 2026 | ransomware_live | — |
| The University of the West Indies | August 17, 2026 | ransomware_live | — |
| White-Daters & Associates, Inc | August 17, 2026 | ransomware_live | — |
| GSW Gemeinschaftsstadtwerke GmbH | August 17, 2026 | ransomware_live | — |
| Double H Equipment | August 16, 2026 | ransomware_live | — |
| ASCII Group | August 16, 2026 | ransomware_live | — |
| Arnall Golden Gregory | August 16, 2026 | ransomware_live | — |
| Zanichelli | August 16, 2026 | ransomware_live | — |
| Botek | August 16, 2026 | ransomware_live | — |
| Loescher editore Torino | August 16, 2026 | ransomware_live | — |
| Desatera Sdn Bhd | August 16, 2026 | ransomware_live | — |
| Megawide | August 16, 2026 | ransomware_live | — |
| INVENSITY | August 16, 2026 | ransomware_live | — |
| MOSAID Technologies | August 16, 2026 | ransomware_live | — |
| WEBA Meubelen | August 16, 2026 | ransomware_live | — |
| Mulino Padano | August 16, 2026 | ransomware_live | — |
| Spoonful of Comfort | August 16, 2026 | ransomware_live | — |
| Coface | August 16, 2026 | ransomware_live | — |
| AGUNSA | August 16, 2026 | ransomware_live | — |
| Teikoku USA | August 16, 2026 | ransomware_live | — |
| motorenmaier gmbh | August 15, 2026 | ransomware_live | — |
| DELTA WAYS | August 15, 2026 | ransomware_live | — |
| Jone Précision | August 15, 2026 | ransomware_live | — |
| Urban Worldwide | August 14, 2026 | ransomware_live | — |
| 3f | August 14, 2026 | ransomware_live | — |
| Lercher Werkzeugbau | August 14, 2026 | ransomware_live | — |
| Radiant | August 14, 2026 | ransomware_live | — |
| Aletex Group | August 14, 2026 | ransomware_live | — |
| Connections | August 14, 2026 | ransomware_live | — |
| FERRARI MANGIMI SRL | August 14, 2026 | ransomware_live | — |
| D & J Beverage Service | August 13, 2026 | ransomware_live | — |
| Wanted | August 12, 2026 | ransomware_live | — |
| United Association Local Union 345 | August 12, 2026 | ransomware_live | — |
| tommer construction | August 11, 2026 | ransomware_live | — |
| Service Evaluation Concepts | August 11, 2026 | ransomware_live | — |
| Crown Group | August 11, 2026 | ransomware_live | — |
| G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L | August 11, 2026 | ransomware_live | — |
| B Wright Drywall | August 10, 2026 | ransomware_live | — |
| City of Winchester | August 10, 2026 | ransomware_live | — |
| HIGEN MOTOR(critical data) | August 10, 2026 | ransomware_live | — |
| Service d'usinage 9002 | August 9, 2026 | ransomware_live | — |
| Université Libre de Bruxelles | August 9, 2026 | ransomware_live | — |
| Grupo Diestra | August 9, 2026 | ransomware_live | — |
| Phithan Phanich | August 9, 2026 | ransomware_live | — |
| Naval Interior Team | August 9, 2026 | ransomware_live | — |
| Price Shoes | August 9, 2026 | ransomware_live | — |
| Harplast SRL | August 9, 2026 | ransomware_live | — |
| pm-energy Die Solarexperten | August 9, 2026 | ransomware_live | — |
| Chun Tai Sing Chemical Industry | August 9, 2026 | ransomware_live | — |
| East Field Corporation | August 9, 2026 | ransomware_live | — |
| Panda Logistics Taichung Branch | August 9, 2026 | ransomware_live | — |
| Energetic Development Corp | August 9, 2026 | ransomware_live | — |
| Synergy Interactive | August 9, 2026 | ransomware_live | — |
| CLLS Co Ltd | August 8, 2026 | ransomware_live | — |
| Clausing | August 8, 2026 | ransomware_live | — |
| Impact Centre Chrétien | August 8, 2026 | ransomware_live | — |
| Depona | August 7, 2026 | ransomware_live | — |
| Nikan Awasisak Agency | August 7, 2026 | ransomware_live | — |
| John C Saunders, CPA | August 7, 2026 | ransomware_live | — |
| EISNER ZT GMBH | August 7, 2026 | ransomware_live | — |
| Filtronic | August 7, 2026 | ransomware_live | — |
| Astro Electroplating | August 7, 2026 | ransomware_live | — |
| J&T Bank and Trust | August 6, 2026 | ransomware_live | — |
| Akuur Law Firm | August 6, 2026 | ransomware_live | — |
| Jakle & Alexander | August 6, 2026 | ransomware_live | — |
| ALIZE (alize-sud.fr) | August 6, 2026 | ransomware_live | — |
| AmSpec | August 6, 2026 | ransomware_live | — |
| Crystal Pharmatech | August 6, 2026 | ransomware_live | — |
| Stade Francais | August 5, 2026 | ransomware_live | — |
| STADLER Sensorik CNC-Technik | August 5, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).