qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Mediapost Spain | May 12, 2026 | ransomware_live | — |
| The Gravity Group | May 12, 2026 | ransomware_live | — |
| Keller Williams Real Estate - Exton | May 11, 2026 | ransomware_live | — |
| AppDirect | May 11, 2026 | ransomware_live | — |
| Lindabury | May 9, 2026 | ransomware_live | — |
| SHERIFF | May 9, 2026 | ransomware_live | — |
| Calidra | May 8, 2026 | ransomware_live | — |
| Fogel Capital Management | May 8, 2026 | ransomware_live | — |
| Ruiz Barbarin Arquitectos Slp | May 8, 2026 | ransomware_live | — |
| DL Cohen Construction | May 8, 2026 | ransomware_live | — |
| CCD Interiors | May 8, 2026 | ransomware_live | — |
| Advanced Laundry Systems | May 8, 2026 | ransomware_live | — |
| CAD-IT UK | May 8, 2026 | ransomware_live | — |
| Shipping Services | May 8, 2026 | ransomware_live | — |
| Imex International | May 8, 2026 | ransomware_live | — |
| Exco Technologies | May 8, 2026 | ransomware_live | — |
| Norcal Training Center | May 7, 2026 | ransomware_live | — |
| Sylvania | May 7, 2026 | ransomware_live | — |
| Le Maire de QUIBERON | May 6, 2026 | ransomware_live | — |
| Asphalt Specialists | May 6, 2026 | ransomware_live | — |
| Time-Cap Labs | May 6, 2026 | ransomware_live | — |
| Panal Seguros S.A. | May 6, 2026 | ransomware_live | — |
| Complastex.com | May 6, 2026 | ransomware_live | — |
| Laclinic-Montreux | May 6, 2026 | ransomware_live | — |
| BMTP | May 6, 2026 | ransomware_live | — |
| Inox Market Service SpA | May 6, 2026 | ransomware_live | — |
| Ahorramas | May 5, 2026 | ransomware_live | — |
| City of Sandstone | May 4, 2026 | ransomware_live | — |
| General Hardware | May 4, 2026 | ransomware_live | — |
| Rizzuto Law Firm | May 4, 2026 | ransomware_live | — |
| Lexus | May 4, 2026 | ransomware_live | — |
| Foxstone Financial | May 4, 2026 | ransomware_live | — |
| Law Office of Steven R Smith | May 4, 2026 | ransomware_live | — |
| Seagate Capital Construction | May 4, 2026 | ransomware_live | — |
| Cushman & Wakefield | May 3, 2026 | ransomware_live | — |
| North Star Signs | May 2, 2026 | ransomware_live | — |
| Standard-Examiner | May 2, 2026 | ransomware_live | — |
| Star Precision | May 2, 2026 | ransomware_live | — |
| LSM Lee | May 2, 2026 | ransomware_live | — |
| Shocco Springs | May 2, 2026 | ransomware_live | — |
| Accurate Nursing Services | May 1, 2026 | ransomware_live | — |
| Jgb | April 30, 2026 | ransomware_live | — |
| Philex Mining | April 30, 2026 | ransomware_live | — |
| Abazia SpA | April 30, 2026 | ransomware_live | — |
| Apothebeauty | April 30, 2026 | ransomware_live | — |
| Zinkan & Barker Development | April 30, 2026 | ransomware_live | — |
| Jayeff Construction | April 30, 2026 | ransomware_live | — |
| See's Candies | April 30, 2026 | ransomware_live | — |
| The Switch Enterprises | April 30, 2026 | ransomware_live | — |
| MES Hybrid Document Systems | April 30, 2026 | ransomware_live | — |
| Antica Sartoria | April 29, 2026 | ransomware_live | — |
| Edenshaw Developments | April 29, 2026 | ransomware_live | — |
| Metro-ILA Funds | April 29, 2026 | ransomware_live | — |
| Probity Contracting Group | April 29, 2026 | ransomware_live | — |
| Eduporium | April 29, 2026 | ransomware_live | — |
| Lifeline PCS | April 28, 2026 | ransomware_live | — |
| Leone Film Group SpA | April 28, 2026 | ransomware_live | — |
| Basch & Keegan | April 28, 2026 | ransomware_live | — |
| TYLin International Group - Taiwan Branch | April 28, 2026 | ransomware_live | — |
| Construction Sciences | April 28, 2026 | ransomware_live | — |
| KarmaData | April 28, 2026 | ransomware_live | — |
| Silicon Alley | April 28, 2026 | ransomware_live | — |
| Inspira | April 27, 2026 | ransomware_live | — |
| A & A Building Material | April 27, 2026 | ransomware_live | — |
| Longwood Engineering Company | April 27, 2026 | ransomware_live | — |
| Exclusive Networks | April 27, 2026 | ransomware_live | — |
| TokyoHosoKogyo Corporation | April 27, 2026 | ransomware_live | — |
| Istarpal | April 26, 2026 | ransomware_live | — |
| Mid Florida Dermatology & Plastic Surgery | April 25, 2026 | ransomware_live | reported in press coverage |
| Travel Expert | April 25, 2026 | ransomware_live | — |
| Woodfields Consultants | April 25, 2026 | ransomware_live | — |
| Chelten House | April 25, 2026 | ransomware_live | — |
| First County FCU | April 25, 2026 | ransomware_live | — |
| SanCor | April 25, 2026 | ransomware_live | — |
| KEMBA Indianapolis Credit Union | April 25, 2026 | ransomware_live | — |
| Leistritz Turbine Technology | April 25, 2026 | ransomware_live | — |
| Cahbo Produkter | April 25, 2026 | ransomware_live | — |
| Buckley Powder | April 25, 2026 | ransomware_live | — |
| Chase Cooper Limited (RiskLogix Solutions) | April 25, 2026 | ransomware_live | — |
| Grupo ABC | April 24, 2026 | ransomware_live | — |
| Flipo Group | April 24, 2026 | ransomware_live | — |
| Priests for Life | April 24, 2026 | ransomware_live | — |
| Progressive Propane | April 24, 2026 | ransomware_live | — |
| Marc Cain | April 24, 2026 | ransomware_live | — |
| Point Four EPoS Solutions | April 24, 2026 | ransomware_live | — |
| City of Napoleon, Ohio | April 23, 2026 | ransomware_live | — |
| Clearview Intelligence | April 23, 2026 | ransomware_live | — |
| The FAFS | April 23, 2026 | ransomware_live | — |
| Manulife Wealth | April 23, 2026 | ransomware_live | — |
| B to B Visions | April 23, 2026 | ransomware_live | — |
| Roman Catholic Archdiocese of St John | April 21, 2026 | ransomware_live | — |
| Avitrans | April 21, 2026 | ransomware_live | — |
| Ferguson Timar | April 21, 2026 | ransomware_live | — |
| STERIMED | April 21, 2026 | ransomware_live | — |
| PTS Office Systems | April 21, 2026 | ransomware_live | — |
| Huonker GmbH | April 21, 2026 | ransomware_live | — |
| Heartland Steel Products | April 21, 2026 | ransomware_live | — |
| Sea Air International Forwarders | April 21, 2026 | ransomware_live | — |
| Kolin Turkey | April 21, 2026 | ransomware_live | — |
| Industrial Carrocera Arbuciense | April 21, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).