qilin
First seen October 8, 2022Active2,413 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Cooperativa de Hospitales de Antioquia - COHAN | April 20, 2026 | ransomware_live | — |
| The Go Solution | April 20, 2026 | ransomware_live | — |
| City'Pro | April 20, 2026 | ransomware_live | — |
| SEL (Safety Engineering Laboratory) | April 20, 2026 | ransomware_live | — |
| SafeRain | April 20, 2026 | ransomware_live | — |
| ATKINSON RITSON SOLICITORS LIMITED | April 20, 2026 | ransomware_live | — |
| B&e Juice | April 20, 2026 | ransomware_live | — |
| Hoeren Gartencenter GmbH | April 20, 2026 | ransomware_live | — |
| Henley | April 19, 2026 | ransomware_live | — |
| The Great Cookie | April 19, 2026 | ransomware_live | — |
| HS Technology Group | April 18, 2026 | ransomware_live | — |
| HBX Group | April 17, 2026 | ransomware_live | — |
| Abazia SpA | April 16, 2026 | ransomware_live | — |
| Gruppo ICM SPA | April 15, 2026 | ransomware_live | — |
| Limkon | April 15, 2026 | ransomware_live | — |
| Basalt Dentistry | April 13, 2026 | ransomware_live | — |
| Frutcola Olmué | April 13, 2026 | ransomware_live | — |
| Alternativa de Moda SAS | April 13, 2026 | ransomware_live | — |
| PGDIS.PAPETIQUE PRO | April 13, 2026 | ransomware_live | — |
| Després Mécanique Mobile | April 13, 2026 | ransomware_live | — |
| Herth+Buss | April 13, 2026 | ransomware_live | — |
| Clearwater Marine Aquarium | April 13, 2026 | ransomware_live | — |
| Pangolin Editions | April 11, 2026 | ransomware_live | — |
| Sadtek | April 10, 2026 | ransomware_live | — |
| Peuker & Alexander | April 10, 2026 | ransomware_live | — |
| Guerin Glass | April 10, 2026 | ransomware_live | — |
| TIS | April 10, 2026 | ransomware_live | — |
| Sonn Law Group | April 10, 2026 | ransomware_live | — |
| Autogalerie Heister | April 10, 2026 | ransomware_live | — |
| SAAM Towage | April 10, 2026 | ransomware_live | — |
| Nan Liu Enterprises | April 10, 2026 | ransomware_live | — |
| A Roettgers | April 10, 2026 | ransomware_live | — |
| Chalmers & Kubeck | April 10, 2026 | ransomware_live | — |
| Hofland | April 10, 2026 | ransomware_live | — |
| HIGASHIYAMA INDUSTRIES Co.,Ltd. | April 9, 2026 | ransomware_live | — |
| www.bnc.com.ve | April 7, 2026 | ransomware_live | — |
| Pacific Building Solutions (PBS) | April 6, 2026 | ransomware_live | — |
| Muller Technology | April 6, 2026 | ransomware_live | — |
| Faulkner County Sheriff's Office | April 2, 2026 | ransomware_live | — |
| J Brand | April 2, 2026 | ransomware_live | — |
| State Road and Tollway Authority | April 1, 2026 | ransomware_live | — |
| Die Linke | April 1, 2026 | ransomware_live | — |
| jursaconsulting | April 1, 2026 | ransomware_live | — |
| CHEK News | April 1, 2026 | ransomware_live | — |
| Neurologic Associates Of Central Brevard | April 1, 2026 | ransomware_live | — |
| Q-Lab | March 31, 2026 | ransomware_live | — |
| Chickasaw Holding | March 31, 2026 | ransomware_live | — |
| SERAM SpA | March 31, 2026 | ransomware_live | — |
| Seeing Machines | March 31, 2026 | ransomware_live | — |
| Service Star Freightways | March 31, 2026 | ransomware_live | — |
| Blantyre Capital | March 30, 2026 | ransomware_live | — |
| Miles Electric | March 30, 2026 | ransomware_live | — |
| Summit Tax Advisory | March 30, 2026 | ransomware_live | — |
| Wm Erath & Son | March 30, 2026 | ransomware_live | — |
| Dow | March 30, 2026 | ransomware_live | — |
| Parkway Reality Group | March 30, 2026 | ransomware_live | — |
| Doctor.com | March 29, 2026 | ransomware_live | — |
| International Customer Care Services | March 29, 2026 | ransomware_live | — |
| TR Construya | March 28, 2026 | ransomware_live | — |
| IBB Institut für Bildung und Beratung | March 28, 2026 | ransomware_live | — |
| ACR1.COM Commercial Roofing | March 27, 2026 | ransomware_live | — |
| Kerjaya Prospek Group | March 27, 2026 | ransomware_live | — |
| ITWAL | March 27, 2026 | ransomware_live | — |
| Fondation Boghossian | March 27, 2026 | ransomware_live | — |
| Operinter | March 27, 2026 | ransomware_live | — |
| Noi Hotels | March 26, 2026 | ransomware_live | — |
| LP Kolding | March 26, 2026 | ransomware_live | — |
| Mac Interiors | March 26, 2026 | ransomware_live | — |
| Living in green, s. r. o. | March 26, 2026 | ransomware_live | — |
| Arnaud | March 26, 2026 | ransomware_live | — |
| Voltamper | March 26, 2026 | ransomware_live | — |
| Maderas Del Noroeste | March 26, 2026 | ransomware_live | — |
| Washoe Tribe | March 26, 2026 | ransomware_live | — |
| Transgas | March 26, 2026 | ransomware_live | — |
| Bedrosians Tile & Stone | March 26, 2026 | ransomware_live | — |
| Louise Medical Center | March 26, 2026 | ransomware_live | — |
| Kaemmerlen Solutions | March 26, 2026 | ransomware_live | — |
| Sacor | March 26, 2026 | ransomware_live | — |
| Netalia | March 26, 2026 | ransomware_live | — |
| Retail Centenario | March 24, 2026 | ransomware_live | — |
| Aroostook Mental Health Services | March 24, 2026 | ransomware_live | — |
| Groupe SFPI | March 23, 2026 | ransomware_live | — |
| Nanometrics | March 23, 2026 | ransomware_live | — |
| Marc Dorcel | March 22, 2026 | ransomware_live | — |
| J E Culp Transport | March 22, 2026 | ransomware_live | — |
| Elite Limousine Plus | March 22, 2026 | ransomware_live | — |
| nPower Technologies | March 22, 2026 | ransomware_live | — |
| Southwire | March 22, 2026 | ransomware_live | — |
| Southern Commercial Real Estate | March 22, 2026 | ransomware_live | — |
| Nanxun Enterprise Co., Ltd. | March 21, 2026 | ransomware_live | — |
| Millerfoto | March 21, 2026 | ransomware_live | — |
| Muffett | March 21, 2026 | ransomware_live | — |
| Grupo Coril | March 21, 2026 | ransomware_live | — |
| VirtualExpo Group | March 20, 2026 | ransomware_live | — |
| AGENCAVI SRL | March 20, 2026 | ransomware_live | — |
| WAL Consultant | March 20, 2026 | ransomware_live | — |
| Denso | March 20, 2026 | ransomware_live | — |
| Enviaseo ESP | March 19, 2026 | ransomware_live | — |
| Accolend | March 19, 2026 | ransomware_live | — |
| GUEGUEN Avocats | March 19, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).