🇷🇺 Qilin¶

Threat-actor battle card · maintained from public sources · last updated 2026-09-10 · also known as Agenda

CategoryRansomware-as-a-Service

AttributionRussia-affiliated (Russian-speaking operators)

First seenJuly 2022 (as Agenda; rebranded Qilin Sept 2022)

StatusActive

Rank#1

Victims L3M335

Victims YTD546

Primary targetsHealthcare, Manufacturing, Finance, Professional services

Overview¶

Qilin (formerly Agenda) is a financially motivated Ransomware-as-a-Service operation first seen in July 2022 and operating as RaaS since February 2023. Affiliate recruitment on Russian-language forums and a hard rule against hitting CIS/former-Soviet targets place its operators in Russia or former-Soviet territory. It has held the #1 spot on the ransomware leaderboard for seven straight months through July 2026 — 546 claimed victims YTD through May 2026 (335 over the trailing L3M March-May); Q2 2026 maintained the same pace. The group's highest-profile August 2026 target is Stade Français Paris (French rugby club), posted August 11 with an August 15 deadline — player passport and ID data published as proof. High-value historical targets include NASCO (Blue Cross Blue Shield administrative data processor, June 29 claim — 🟥 unverified) and the Central Bank of Libya (June 22, confirmed breach). Q1 2026 total: 338 victims per Check Point Research.

Tradecraft¶

Double-extortion: exfiltrate, then encrypt; leak on a dedicated leak site (DLS).
Affiliates keep ~80–85% of proceeds (operator takes 15–20%).
Spear-phishing of the C-suite for initial access; harvesting of Chrome credentials and VPN credentials.
Windows Subsystem for Linux (WSL) abuse to evade endpoint detection.
Exploitation of VPN and network appliance vulnerabilities for initial access (including Check Point CVE-2026-50751, Cisco, and Fortinet products confirmed in 2026). Cisco Talos (Sep 9, 2026) attributes one of three distinct post-compromise clusters exploiting the new Cisco Secure FMC auth-bypass flaw (CVE-2026-20079, CVSS 10.0) to Qilin-affiliate ransomware-precursor activity, alongside separate state-sponsored and Sandworm-linked clusters on the same CVE.
Social-pressure tactics: deadline-driven public leak-site postings with preview data (IDs, passports) to force payment decisions within 72–96 hours.

Notable recent victims¶

D&J Beverage Service (beverages/US) — DLS August 13, 2026; 🟥 unverified
B Wright Drywall (construction/Canada) — DLS August 11–13, 2026; 🟥 unverified
Stade Français Paris (sports organisation/France) — DLS August 11, 2026; Aug 15 deadline; player passport/ID images published as proof; club filed complaint with French authorities; no payment confirmed
Alan F. Burke CPA (accounting/US) — DLS July 11, 2026; 🟥 unverified
Bronken's Distributing (distribution/wholesale/US) — DLS July 11, 2026; 🟥 unverified
The Schuett Companies (real estate/construction/US) — DLS July 10, 2026; 🟥 unverified
Sintax (legal/Belgium) — DLS July 10, 2026; 🟥 unverified
Eurodefi (financial services/EU) — DLS July 10, 2026; 🟥 unverified
Inter Power Engineering (electronics/Singapore) — DLS July 9, 2026; 🟥 unverified
NASCO (US healthcare tech, Blue Cross Blue Shield administrative data processor) — DLS June 29, 2026; most significant healthcare infrastructure target of the June 26-29 window; 🟥 unverified, no victim statement
Central Bank of Libya — SWIFT payment system components targeted; breach confirmed June 22, 2026; affected systems isolated; CBL investigations ongoing
Covenant Health (US healthcare) — 478,188 individuals affected, ~850 GB leaked (May 2025 attack; notifications confirmed)
Isuzu Motors (Thailand, automotive) — DLS June 8, 2026

Assessment¶

The undisputed pace-setter of the current ransomware landscape — seven consecutive months at #1. Persistent, well-tooled, and increasingly targeting high-visibility victims to sustain affiliate credibility (Stade Français, Central Bank of Libya, NASCO). The origin group for The Gentlemen splinter faction, which now ranks #2 independently. August 2026 continues the pace of July and June; the Stade Français posting — European sports organisation with high public profile, player PII as leverage — represents a calculated reputational escalation aimed at extracting payment before the Aug 15 deadline. No sign of operational deceleration. Healthcare (including insurance administrators), finance, critical infrastructure, and now high-profile sports organisations all appear in the active victim portfolio. The NASCO DLS claim, if confirmed, would represent a systemic healthcare supply-chain breach affecting tens of millions of Americans via BCBS plans.

Sources¶

🗂️ Attacks & victims¶

All disclosed victims attributed to this actor, newest first.

September 2026

Sep 03 Complete Packaging Solutions Qilin Ransomware · Professional Services · UK Qilin DLS claim Sep 3 2026; UK business services and packaging solutions provider. 🟥 Unverified DLS claim. · Sources: https://www.dexpose.io/qilin-ransomware-targets-complete-packaging-solutions/

August 2026

Aug 30 AFSARD Qilin Ransomware · Government · GBR Qilin ransomware DLS claim posted August 30 2026. Organization based in Milton Keynes UK. Attack date not confirmed. · Sources: https://www.hookphish.com/blog/ransomware-group-qilin-hits-afsard/

Aug 29 Bandit Industries Qilin Ransomware · Manufacturing · USA Qilin DLS claim Aug 29, 2026; US industrial equipment manufacturer; scope and data volume unconfirmed · Sources: https://www.ransomware.live/summary/

Aug 29 LAPoco Architects Qilin Ransomware · Professional Services · USA Qilin DLS claim Aug 29, 2026; architecture firm; scope and data volume unconfirmed · Sources: https://www.ransomware.live/summary/

Aug 27 Providence Investments Qilin Ransomware · Financial Services · USA DLS posting Aug 27; no data volume or proof of exfiltration provided; 🟥 unverified claim · Sources: https://www.redpacketsecurity.com/qilin-ransomware-victim-providence-investments/ · https://ransomware.live/group/qilin

Aug 27 Displaydata Qilin Ransomware · Technology · UK DLS posting Aug 27; UK-based tech company specialising in electronic shelf labels; no data volume or proof of exfiltration provided; 🟥 unverified claim · Sources: https://www.redpacketsecurity.com/qilin-ransomware-victim-displaydata/ · https://ransomware.live/id/RGlzcGxheWRhdGFAcWlsaW4=

Aug 26 Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Qilin Ransomware · Government & Defense · USA Qilin posted ATF (atf.gov) to DLS Aug 26. ATF confirmed 'major cybersecurity incident' on a standalone system isolated from enterprise network. DOJ designated it a major incident under federal guidelines. No data samples published by Qilin. Standalone system; eForms and enterprise network unaffected. · Sources: https://cybernews.com/news/qilin-ransomware-bureau-alcohol-tobacco-firearms-atf-cyberattack/

Aug 26 Air International Thermal Systems Qilin Ransomware · Manufacturing · USA Qilin DLS posting Aug 26. Air International Thermal Systems is a US provider of thermal management and HVAC solutions for industrial and defense applications. Unverified DLS claim; no data samples published. · Sources: https://www.dexpose.io/qilin-ransomware-strikes-air-international-thermal-systems/

Aug 26 Metal Conversions Qilin Ransomware · Manufacturing · USA Qilin DLS posting Aug 26. Metal Conversions is a US metals manufacturing company. Unverified DLS claim; no data samples published. · Sources: https://www.dexpose.io/qilin-ransomware-strikes-metal-conversions/

Aug 23 Clear Align Qilin Ransomware · Technology · USA Optical engineering company; Qilin DLS claim Aug 23 threatening data exposure · Sources: https://www.dexpose.io/qilin-ransomware-attack-on-clear-align/

Aug 23 Difor Qilin Ransomware · Distribution · Chile Chilean distribution/retail company; Qilin DLS claim Aug 23 threatening data exposure · Sources: https://www.dexpose.io/qilin-ransomware-group-strikes-chilean-company-difor/

Aug 23 Aurore Development S.p.A. Qilin Ransomware · Professional Services · Italy Italian business services company; Qilin DLS claim Aug 23 threatening data exposure · Sources: https://www.dexpose.io/qilin-targets-aurore-development-s-p-a-in-ransomware-attack/

Aug 22 PenLink Qilin Ransomware · Technology / Surveillance · USA Qilin ransomware DLS claim August 2026; PenLink is a US surveillance technology company providing investigative tools to law enforcement; data scope unconfirmed · Sources: https://www.galaxywarden.com/blog/breach/penlink-qilin-2026-08

Aug 22 Agunsa Qilin Ransomware · Logistics / Port Services · Chile Qilin ransomware DLS claim August 2026; Agunsa is a major Chilean port and logistics services company; data scope unconfirmed · Sources: https://www.galaxywarden.com/blog/breach/agunsa-qilin-2026-08

Aug 13 D&J Beverage Service Qilin Ransomware · Beverages · US Qilin DLS claim August 13, 2026; scope unconfirmed. · Sources: https://www.ransomware.live/group/qilin

Aug 12 B Wright Drywall Qilin Ransomware · Construction · CAN DLS claim by Qilin (Aug 11-13 posting); Canadian construction firm; scope and data volume unverified · Sources: https://www.ransomware.live/group/qilin

Aug 11 Stade Français Paris Qilin Ransomware · Sports · FR Qilin DLS August 11, 2026; Aug 15 deadline; player passport/ID data published as proof-of-breach; club filed complaint with French authorities; no payment confirmed. · Sources: https://www.redpacketsecurity.com/qilin-ransomware-victim-stade-francais/

Aug 10 Astro Electroplating Qilin Ransomware · Manufacturing · US Qilin DLS posting August 10, 2026; data scope unconfirmed · Sources: https://www.ransomware.live/

Aug 10 Chung Tai Shin Chemical Industry Co. Qilin Ransomware · Chemicals · TW Qilin DLS posting August 10, 2026; chemicals and manufacturing sector; data scope unconfirmed · Sources: https://www.ransomware.live/

Aug 08 Filtronic plc Qilin Ransomware · Manufacturing / Defence Electronics · UK Qilin DLS claim August 8 2026; UK-listed manufacturer of RF/microwave components for defence and telecoms infrastructure; no statement from Filtronic; data scope and impact unconfirmed · Sources: https://www.hendryadrian.com/ransom-filtronic-aug-2026/

Aug 08 Clausing Industrial Qilin Ransomware · Manufacturing / Machine Tools · US Qilin DLS claim August 8 2026; Michigan-based metalworking machinery manufacturer; no statement from Clausing; data scope and impact unconfirmed · Sources: https://www.ransomware.live/group/qilin

Aug 08 CLLS Co Ltd Qilin Ransomware · Unknown · Unknown Qilin DLS claim August 8 2026; sector and country of origin unconfirmed; no victim statement · Sources: https://www.ransomware.live/group/qilin

Aug 04 RUPP Spritzguss Qilin Ransomware · Manufacturing / Plastics · Germany Qilin DLS claim approximately August 4 2026; German plastics injection-moulding manufacturer; no statement from RUPP; data scope and impact unconfirmed · Sources: https://www.ransomware.live/

Aug 03 Service Electric Qilin Ransomware · Telecommunications · US Qilin DLS claim approximately August 3 2026; US regional telecom; no statement from Service Electric; data scope and impact unconfirmed · Sources: https://www.ransomware.live/

July 2026

Jul 31 Hawaii Family Dental Qilin Ransomware · Healthcare · US Qilin posted Hawaii Family Dental on DLS July 31; dental healthcare provider; Qilin exploiting CVE-2026-0257 (PAN-OS GlobalProtect) as primary initial access; 1358+ cumulative Qilin victims · Sources: https://www.ransomware.live/ https://cybersecuritynews.com/qilin-ransomware-claims-1358-victims/

Jul 25 Traffic Control and Road Safety Services Qilin Ransomware · Government/Transportation · Unknown DLS posting July 25 2026 by Qilin. Sector and country unconfirmed from snippets. · Sources: https://www.ransomware.live/

Jul 25 Guntert & Zimmerman Qilin Ransomware · Manufacturing · DE DLS posting July 25 2026 by Qilin. Guntert & Zimmerman manufactures heavy concrete paving equipment. Country inferred from name. · Sources: https://www.ransomware.live/

Jul 25 Plitvicka Jezera Nacionalni Park Qilin Ransomware · Tourism/Government · HR Plitvice Lakes National Park (Croatia), UNESCO World Heritage Site. DLS posting July 25 2026 by Qilin. Data scope unconfirmed. · Sources: https://www.ransomware.live/

Jul 25 Principle Diagnostics Laboratory Qilin Ransomware · Healthcare · Unknown DLS posting July 25 2026 by Qilin. Diagnostic laboratory; sector confirmed, country unconfirmed. · Sources: https://www.ransomware.live/

Jul 25 GURR Abdichtungstechnik GmbH Qilin Ransomware · Construction · DE German waterproofing/sealing technology firm. DLS posting July 25 2026 by Qilin. Data scope unconfirmed. · Sources: https://www.ransomware.live/

Jul 25 Jubilee Jobs Qilin Ransomware · Business Services/Staffing · Unknown DLS posting July 25 2026 by Qilin. Employment/staffing services firm. Country and data scope unconfirmed. · Sources: https://www.ransomware.live/

Jul 25 The Myers Y Cooper Qilin Ransomware · Professional Services · Unknown DLS posting July 25 2026 by Qilin. Professional services firm; sector and country unconfirmed from snippets. · Sources: https://www.ransomware.live/

Jul 22 Recsa Qilin Ransomware · Business Services / Security · South Africa Qilin DLS claim posted Jul 22-23; data leak threatened if no negotiations. Unverified — verify before treating as confirmed breach. · Sources: https://www.dexpose.io/qilin-ransomware-strikes-recsa-in-south-africa/

Jul 19 Eana Qilin Ransomware · telecommunications (satellite/connectivity) · Argentina Qilin DLS posting July 19; data claimed exfiltrated; unverified — no public statement from Eana · Sources: https://www.ransomware.live

Jul 19 Synergy Products Qilin Ransomware · manufacturing (industrial products) · United States Qilin DLS posting July 19; data claimed exfiltrated; unverified — no public statement from Synergy Products · Sources: https://www.ransomware.live

Jul 18 Droguería Martorani Qilin Ransomware · healthcare (pharmaceutical distribution) · Argentina Argentine medical and hospital products importer/distributor, Buenos Aires; Qilin DLS claim Jul 18, 2026; founded 1970 by Luis Alberto Martorani; distributes medical equipment nationally; 🟥 unverified · Sources: https://ransomware.live/id/RHJvZ3VlcsOtYSBNYXJ0b3JhbmlAcWlsaW4=

Jul 18 Salina Supply Qilin Ransomware · retail (home improvement/building supplies) · United States Qilin DLS posting July 18; data claimed exfiltrated; unverified — no public statement from Salina Supply · Sources: https://www.ransomware.live

Jul 17 Acosol Qilin Ransomware · utilities (water) · Spain Spanish public water utility; Qilin DLS claim Jul 17, 2026; company confirmed cyberattack, activated security protocols, warned subscribers personal data including national ID numbers, contract info, and payment methods may be compromised; NIS2-classified critical infrastructure · Sources: https://www.ransomware.live/id/QWNvc29sQHFpbGlu · https://www.hendryadrian.com/acosol-suffers-cyberattack-urges-customers-to-stay-alert/

Jul 17 Cafar Qilin Ransomware · unknown · Argentina Argentine organisation; Qilin DLS claim Jul 17, 2026; cafar.org.ar; sector unconfirmed; 🟥 unverified · Sources: https://ransomware.live/id/Q2FmYXJAcWlsaW4=

Jul 17 Danone Qilin Ransomware · food/beverage manufacturing · FR Qilin DLS claim July 17: 221 GB claimed (91,558 files) including year-end financial summaries, customer account database, NDAs, and quarterly sales reports 2023-2025. Danone has not confirmed; treat as claim only. · Sources: https://cybernews.com/news/danone-evian-silk-international-delight-qilin-ransomware-attack/ · https://www.ransomware.live/group/qilin

Jul 14 Sedemi Qilin Ransomware · unknown · Unknown Claimed on Qilin DLS July 14; sector and country unconfirmed · Sources: https://www.ransomware.live/group/qilin

Jul 13 Allied Plumbing Heating & Cooling Qilin Ransomware · services · US HVAC/plumbing services company claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · breachsense.com

Jul 12 Retelit SpA Qilin Ransomware · technology · Italy Italian IT services and telecommunications infrastructure provider claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · undercodenews.com

Jul 12 Carolina Agri-Power Qilin Ransomware · agriculture · US Agricultural equipment dealer claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · breachsense.com

Jul 12 Century Equities Qilin Ransomware · real estate · US Real estate company claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · breachsense.com

Jul 11 Alan F. Burke CPA Qilin Ransomware · accounting · US Qilin DLS claim July 11, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 11 Bronken's Distributing Qilin Ransomware · distribution · wholesale/US Qilin DLS claim July 11, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 10 The Schuett Companies Qilin Ransomware · real estate · construction/US Qilin DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 10 Eurodefi Qilin Ransomware · financial services · EU Qilin DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 10 Sintax Qilin Ransomware · legal services · Belgium Qilin DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 09 Inter Power Engineering Qilin Ransomware · electronics manufacturing · Singapore Qilin DLS claim July 9, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 08 Accelirate Inc. Qilin Ransomware · IT services · intelligent automation/US Qilin DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/qilin · Sources: [SharkStriker] · [ransomware.live]

Jul 08 S.J. Louis Construction Qilin Ransomware · construction · US Qilin DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/qilin · Sources: [SharkStriker] · [ransomware.live]

Jul 07 Next Clinics Qilin Ransomware · healthcare · US Qilin DLS claim July 7, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 06 Precision Steel Services Qilin Ransomware · manufacturing · steel service center/US Qilin DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/qilin-ransomware-attack-on-precision-steel-services/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jul 06 Wood Ellis & Wood CPA Qilin Ransomware · professional services · accounting/US Qilin DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/qilin-ransomware-attack-on-wood-ellis-wood-cpa/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jul 06 Max Fordham Qilin Ransomware · professional services · building engineering/UK independent building engineering consultancy (MEP/sustainability; clients include museums, schools, housing); Qilin DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/qilin-ransomware-targets-max-fordham-in-uk-cyberattack/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jul 06 Grupo Inteca Qilin Ransomware · construction · Mexico Qilin DLS claim July 6, 2026; internal files claimed exfiltrated; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 Sisint Qilin Ransomware · technology · Portugal Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 Sitmatic GmbH Qilin Ransomware · IT services · Germany Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 TQ Financial Services Qilin Ransomware · financial services · unknown Qilin DLS claim July 3–4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 Md Lewis Qilin Ransomware · sector unknown · US Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 Goodwill Manasota Qilin Ransomware · nonprofit · thrift retail/US Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 Chemco Qilin Ransomware · manufacturing · Canada Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 02 Dixie Beverage West Qilin Ransomware · beverage distribution · US Qilin DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 02 Pennant Hills Golf Club Qilin Ransomware · hospitality · Australia Qilin DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · https://www.hendryadrian.com/ransom-pennant-hills-golf-club-jul-2026/ · Sources: [ransomware.live] · [hendryadrian.com]

Jul 01 Dennis Waters Rental Properties Qilin Ransomware · real estate · US residential rental property company; Qilin DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]

Jul 01 Dynamic Laser Solutions Ltd. Qilin Ransomware · industrial machinery · UK UK-based laser cutting and industrial machinery solutions company; Qilin DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]

Jul 01 Laughlin Nunnally Hood & Crum Qilin Ransomware · legal services · US US law firm; Qilin DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]

June 2026

Jun 30 KALIACT ANCHETA et Associés Qilin Ransomware · legal services · France French legal advisory firm; Qilin DLS June 30, 2026; data scope unconfirmed; 🟥 unverified · https://socradar.io/free-tools/ransomware-intelligence/victims/kaliact-ancheta-et-associs-67e467e9 · https://www.ransomware.live/id/S0FMSUFDVCBBTkNIRVRBIGV0IEFzc29jaXNAcWlsaW4 · Sources: [SOCRadar] · [ransomware.live]

Jun 30 KUNERT Fashion Qilin Ransomware · manufacturing · legwear/Germany German legwear and hosiery manufacturer; Qilin DLS June 30, 2026; data scope unconfirmed; 🟥 unverified · https://www.redpacketsecurity.com/qilin-ransomware-victim-kunert-fashion/ · https://www.ransomware.live/group/qilin · Sources: [RedPacket Security] · [ransomware.live]

Jun 30 Chamco Qilin Ransomware · manufacturing · Canada Canadian manufacturing company; Qilin DLS claim June 30, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jun 29 Axionlog Qilin Ransomware · logistics · supply chain/unknown region Qilin DLS claim June 29, 2026; sector and data scope unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jun 29 NASCO Qilin Ransomware · healthcare technology · US NASCO provides Blue Cross Blue Shield plan administrative data processing for multiple BCBS plans nationwide; Qilin DLS claim June 29, 2026; data scope unconfirmed; 🟥 unverified — verify before treating as a breach · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jun 29 Bristol Place Corporation Qilin Ransomware · healthcare services · US family-owned healthcare services organization; Qilin DLS claim June 29, 2026; data scope and impact unconfirmed; 🟥 unverified · https://ransomware.live/id/QnJpc3RvbCBQbGFjZUBxaWxpbg== · https://www.breachsense.com/breaches/2026/june/ · Sources: [ransomware.live] · [Breachsense]

Jun 29 Musashino University Qilin Ransomware · education · Japan Qilin DLS claim June 29, 2026; data scope and impact unconfirmed; previously uncaptured; 🟥 unverified · https://www.redpacketsecurity.com/qilin-ransomware-victim-musashino-university/ · Sources: [RedPacket Security]

Jun 28 1-800-Dentist Qilin Ransomware · consumer services · dental referral/US US national dental referral and appointment-scheduling service (connects patients with 25,000+ dentist offices nationwide); Qilin DLS claim June 28, 2026; estimated attack date June 28; data scope and impact unconfirmed; 🟥 unverified — verify before treating as a breach · https://www.redpacketsecurity.com/qilin-ransomware-victim-1-800-dentist/ · https://www.ransomware.live/id/MS04MDAtZGVudGlzdEBxaWxpbg== · Sources: [RedPacket Security] · [ransomware.live]

Jun 28 TransCore Qilin Ransomware · transportation technology · ITS/US nationwide electronic toll collection and intelligent transportation systems provider (~$420M revenue, 2,068 employees; ST Engineering subsidiary; serves 8 of 10 largest US tolling agencies and provides traffic management systems worldwide); Qilin DLS claim June 28, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jun 25 ISOPLUS Qilin Ransomware · pharmaceuticals · Greece Greek pharmaceutical company; Qilin DLS claim June 25, 2026; data scope and impact unconfirmed · https://www.dexpose.io/qilin-ransomware-targets-greek-pharma-leader-isoplus/ · https://www.hendryadrian.com/ransom-isoplus-jun-2026/ · Sources: [DeXpose] · [hendryadrian.com]

Jun 24 Cash Canada Qilin Ransomware · financial services · Canada DLS claim June 24, 2026; data scope and impact unconfirmed · https://www.redpacketsecurity.com/qilin-ransomware-victim-cash-canada/ · https://www.ransomware.live/group/qilin · Sources: [RedPacket Security] · [ransomware.live]

Jun 23 Lee International Qilin Ransomware · sector · US DLS claim June 23, 2026; data scope and impact unconfirmed; no Qilin proof sample or ransom demand publicly published · https://www.redpacketsecurity.com/qilin-ransomware-victim-lee-international/ · https://www.ransomware.live/group/qilin · Sources: [RedPacket Security] · [ransomware.live]

Jun 22 Central Bank of Libya Qilin Ransomware · banking · central bank/Libya ransomware confirmed; SWIFT payment system components targeted; virtual infrastructure and internal systems hit; CBL isolated affected systems June 22; investigations ongoing; no confirmed customer data breach or correspondent bank data exposure · https://www.ransomware.live/id/Q2VudHJhbCBCYW5rIG9mIExpYnlhQHFpbGlu · https://libyaobserver.ly/news/cbl-cyberattack-contained-investigations-ongoing-no-signs-impact-customer-accounts · Sources: [ransomware.live] · [Libya Observer]

Jun 20 Central Florida Cosmetic & Family Dentistry Qilin Ransomware · healthcare · US Sources: ransomware.live DLS

Jun 20 Pacific Lamp & Supply Qilin Ransomware · manufacturing · US industrial lighting and electrical supply company; Qilin DLS claim June 20, 2026; data scope and impact unconfirmed; 🟥 unverified — verify before treating as breach · https://www.redpacketsecurity.com/qilin-ransomware-victim-pacific-lamp-supply/ · https://www.ransomware.live/id/UGFjaWZpYyBMYW1wICYgU3VwcGx5QHFpbGlu · Sources: [RedPacket Security] · [ransomware.live]

Jun 19 PJ Daly Contracting Qilin Ransomware · construction · Ireland construction contractor; DLS claim June 19, 2026; data scope and impact unconfirmed · https://www.redpacketsecurity.com/qilin-ransomware-victim-pj-daly-contracting/ · https://ransomware.live/id/UEogRGFseSBDb250cmFjdGluZ0BxaWxpbg== · Sources: [RedPacket Security] · [ransomware.live]

Jun 15 distinetmurcia.es Qilin Ransomware · services · Spain Sources: ransomware.live DLS

Jun 15 Grupo Indi Qilin Ransomware · civil engineering · construction/Mexico prominent Mexican civil engineering and construction company; Qilin DLS claim June 15, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/qilin-ransomware-targets-mexican-construction-leader-grupo-indi/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jun 08 Covenant Health Qilin Ransomware · healthcare · US Qilin attack May 2025; ~850GB leaked, 478,188 individuals affected (notifications confirmed) · Sources: The Record / SecurityWeek

Jun 08 The Banyans Health and Wellness Qilin Ransomware · healthcare · Australia Sources: ransomware.live DLS

Jun 08 Kinetic Education Qilin Ransomware · education · Australia Sources: ransomware.live DLS

Jun 08 SatCom CX Qilin Ransomware · marketing services · US Sources: ransomware.live DLS

Jun 08 Isuzu Motors Qilin Ransomware · automotive manufacturing · Thailand Sources: ransomware.live DLS

Jun 08 Opéra Comique Qilin Ransomware · arts-culture · France Sources: ransomware.live DLS

Jun 08 Shipping Association of NY and NJ Qilin Ransomware · maritime-logistics · US Sources: ransomware.live DLS

Jun 05 Avcon Jet Qilin Ransomware · aviation · Austria Sources: ransomware.live DLS

Jun 05 Trican Well Service Qilin Ransomware · oilfield services · Canada Sources: ransomware.live DLS

Jun 05 Don Don Qilin Ransomware · retail · food Sources: ransomware.live DLS

March 2026

Mar 01 Kennedy McLaughlin & Associates Qilin Ransomware · accounting · Australia Qilin ransomware attack; company confirmed "cyber incident" publicly; data published approximately May 28, 2026; reported to ACSC and OAIC; 🟨 company-confirmed breach · https://www.cyberdaily.au/security/13668-exclusive-accounting-firm-kennedy-mclaughlin-confirms-cyber-incident-following-qilin-ransomware-attack · https://ransomware.live/id/S2VubmVkeSwgTWNMYXVnaGxpbiAmIEFzc29jaWF0ZXNAcWlsaW4= · Sources: [Cyber Daily] · [ransomware.live]

← All threat actors · Full victim database →