qilin
First seen October 8, 2022Active2,262 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| MES Hybrid Document Systems | April 30, 2026 | ransomware_live | — |
| Antica Sartoria | April 29, 2026 | ransomware_live | — |
| Edenshaw Developments | April 29, 2026 | ransomware_live | — |
| Metro-ILA Funds | April 29, 2026 | ransomware_live | — |
| Probity Contracting Group | April 29, 2026 | ransomware_live | — |
| Eduporium | April 29, 2026 | ransomware_live | — |
| Lifeline PCS | April 28, 2026 | ransomware_live | — |
| Leone Film Group SpA | April 28, 2026 | ransomware_live | — |
| Basch & Keegan | April 28, 2026 | ransomware_live | — |
| TYLin International Group - Taiwan Branch | April 28, 2026 | ransomware_live | — |
| Construction Sciences | April 28, 2026 | ransomware_live | — |
| KarmaData | April 28, 2026 | ransomware_live | — |
| Silicon Alley | April 28, 2026 | ransomware_live | — |
| Inspira | April 27, 2026 | ransomware_live | — |
| A & A Building Material | April 27, 2026 | ransomware_live | — |
| Longwood Engineering Company | April 27, 2026 | ransomware_live | — |
| Exclusive Networks | April 27, 2026 | ransomware_live | — |
| TokyoHosoKogyo Corporation | April 27, 2026 | ransomware_live | — |
| Istarpal | April 26, 2026 | ransomware_live | — |
| Mid Florida Dermatology & Plastic Surgery | April 25, 2026 | ransomware_live | — |
| Travel Expert | April 25, 2026 | ransomware_live | — |
| Woodfields Consultants | April 25, 2026 | ransomware_live | — |
| Chelten House | April 25, 2026 | ransomware_live | — |
| First County FCU | April 25, 2026 | ransomware_live | — |
| SanCor | April 25, 2026 | ransomware_live | — |
| KEMBA Indianapolis Credit Union | April 25, 2026 | ransomware_live | — |
| Leistritz Turbine Technology | April 25, 2026 | ransomware_live | — |
| Cahbo Produkter | April 25, 2026 | ransomware_live | — |
| Buckley Powder | April 25, 2026 | ransomware_live | — |
| Chase Cooper Limited (RiskLogix Solutions) | April 25, 2026 | ransomware_live | — |
| Grupo ABC | April 24, 2026 | ransomware_live | — |
| Flipo Group | April 24, 2026 | ransomware_live | — |
| Priests for Life | April 24, 2026 | ransomware_live | — |
| Progressive Propane | April 24, 2026 | ransomware_live | — |
| Marc Cain | April 24, 2026 | ransomware_live | — |
| Point Four EPoS Solutions | April 24, 2026 | ransomware_live | — |
| City of Napoleon, Ohio | April 23, 2026 | ransomware_live | — |
| Clearview Intelligence | April 23, 2026 | ransomware_live | — |
| The FAFS | April 23, 2026 | ransomware_live | — |
| Manulife Wealth | April 23, 2026 | ransomware_live | — |
| B to B Visions | April 23, 2026 | ransomware_live | — |
| Roman Catholic Archdiocese of St John | April 21, 2026 | ransomware_live | — |
| Avitrans | April 21, 2026 | ransomware_live | — |
| Ferguson Timar | April 21, 2026 | ransomware_live | — |
| STERIMED | April 21, 2026 | ransomware_live | — |
| PTS Office Systems | April 21, 2026 | ransomware_live | — |
| Huonker GmbH | April 21, 2026 | ransomware_live | — |
| Heartland Steel Products | April 21, 2026 | ransomware_live | — |
| Sea Air International Forwarders | April 21, 2026 | ransomware_live | — |
| Kolin Turkey | April 21, 2026 | ransomware_live | — |
| Industrial Carrocera Arbuciense | April 21, 2026 | ransomware_live | — |
| Cooperativa de Hospitales de Antioquia - COHAN | April 20, 2026 | ransomware_live | — |
| The Go Solution | April 20, 2026 | ransomware_live | — |
| City'Pro | April 20, 2026 | ransomware_live | — |
| SEL (Safety Engineering Laboratory) | April 20, 2026 | ransomware_live | — |
| SafeRain | April 20, 2026 | ransomware_live | — |
| ATKINSON RITSON SOLICITORS LIMITED | April 20, 2026 | ransomware_live | — |
| B&e Juice | April 20, 2026 | ransomware_live | — |
| Hoeren Gartencenter GmbH | April 20, 2026 | ransomware_live | — |
| Henley | April 19, 2026 | ransomware_live | — |
| The Great Cookie | April 19, 2026 | ransomware_live | — |
| HS Technology Group | April 18, 2026 | ransomware_live | — |
| HBX Group | April 17, 2026 | ransomware_live | — |
| Gruppo ICM SPA | April 15, 2026 | ransomware_live | — |
| Limkon | April 15, 2026 | ransomware_live | — |
| Basalt Dentistry | April 13, 2026 | ransomware_live | — |
| Frutcola Olmué | April 13, 2026 | ransomware_live | — |
| Alternativa de Moda SAS | April 13, 2026 | ransomware_live | — |
| PGDIS.PAPETIQUE PRO | April 13, 2026 | ransomware_live | — |
| Després Mécanique Mobile | April 13, 2026 | ransomware_live | — |
| Herth+Buss | April 13, 2026 | ransomware_live | — |
| Clearwater Marine Aquarium | April 13, 2026 | ransomware_live | — |
| Pangolin Editions | April 11, 2026 | ransomware_live | — |
| Sadtek | April 10, 2026 | ransomware_live | — |
| Peuker & Alexander | April 10, 2026 | ransomware_live | — |
| Guerin Glass | April 10, 2026 | ransomware_live | — |
| TIS | April 10, 2026 | ransomware_live | — |
| Sonn Law Group | April 10, 2026 | ransomware_live | — |
| Autogalerie Heister | April 10, 2026 | ransomware_live | — |
| SAAM Towage | April 10, 2026 | ransomware_live | — |
| Nan Liu Enterprises | April 10, 2026 | ransomware_live | — |
| A Roettgers | April 10, 2026 | ransomware_live | — |
| Chalmers & Kubeck | April 10, 2026 | ransomware_live | — |
| Hofland | April 10, 2026 | ransomware_live | — |
| HIGASHIYAMA INDUSTRIES Co.,Ltd. | April 9, 2026 | ransomware_live | — |
| www.bnc.com.ve | April 7, 2026 | ransomware_live | — |
| Pacific Building Solutions (PBS) | April 6, 2026 | ransomware_live | — |
| Muller Technology | April 6, 2026 | ransomware_live | — |
| Faulkner County Sheriff's Office | April 2, 2026 | ransomware_live | — |
| J Brand | April 2, 2026 | ransomware_live | — |
| State Road and Tollway Authority | April 1, 2026 | ransomware_live | — |
| Die Linke | April 1, 2026 | ransomware_live | — |
| jursaconsulting | April 1, 2026 | ransomware_live | — |
| CHEK News | April 1, 2026 | ransomware_live | — |
| Neurologic Associates Of Central Brevard | April 1, 2026 | ransomware_live | — |
| Q-Lab | March 31, 2026 | ransomware_live | — |
| Chickasaw Holding | March 31, 2026 | ransomware_live | — |
| SERAM SpA | March 31, 2026 | ransomware_live | — |
| Seeing Machines | March 31, 2026 | ransomware_live | — |
| Service Star Freightways | March 31, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).