Privacy UnpackedRansomware gang
Qilin
Claims on its leak site since 8 October 2022, the most of any gang in the last 12 months
- Claims, 12 months
- 1,539
- Last 30 days
- 122
- All claims
- 2,633
- Last claim
- 27 October 2026
Where its claimed victims are
Sectors
Claims matched to an official notice
16 organisations Qilin claimed also filed a breach notice with a regulator, all of them after the claim (a median of 105 days later). Matched by name: the notice does not say who the attacker was.
- John G. Yphantides, a Professional Law Corporation
Claimed 13 May 2026 · notice filed with the California Attorney General 16 October 2026 - Magna Hospitality Group
Claimed 22 October 2025 · notice filed with the California Attorney General 13 October 2026 - Cornerstone Staffing Solutions, Inc.
Claimed 13 November 2025 · notice filed with the California Attorney General 11 September 2026 - HumanEdge, Inc
Claimed 28 May 2026 · notice filed with the Indiana Attorney General 1 September 2026 - See’s Candies, Inc.
Claimed 30 April 2026 · notice filed with the California Attorney General 13 August 2026 - Cushman & Wakefield
Claimed 4 May 2026 · notice filed with the California Attorney General 7 August 2026 - NFI North, Inc.
Claimed 22 September 2025 · notice filed with the US Department of Health and Human Services 5 August 2026 - JC Resorts LLC
Claimed 14 February 2026 · notice filed with the California Attorney General 28 April 2026 - Covenant Health, Inc.
Claimed 24 June 2025 · notice filed with the California Attorney General 2 January 2026 - Lonich Patton Ehrlich Policastri
Claimed 10 December 2025 · notice filed with the California Attorney General 17 December 2025 - Inotiv, Inc.
Claimed 19 August 2025 · notice filed with the California Attorney General 2 December 2025 - Lee Enterprises
Claimed 27 February 2025 · notice filed with the California Attorney General 4 June 2025 - Promises2Kids
Claimed 16 August 2024 · notice filed with the California Attorney General 16 May 2025 - Crossroads Trading Co., Inc.
Claimed 21 February 2025 · notice filed with the California Attorney General 25 March 2025 - Holstein Association USA, Inc.
Claimed 8 May 2024 · notice filed with the Washington Attorney General 27 June 2024 - Consulting Radiologists LTD. (“CRL”)
Claimed 15 May 2024 · notice filed with the California Attorney General 14 June 2024
What a claim is, and is not
A claim is a ransomware gang naming an organisation on its leak site, usually to pressure it into paying. It is the gang’s word: some claims are false, recycled from older breaches or exaggerated, and a claim says nothing about whose personal data, if any, was taken. That is why we count claims but do not list the organisations, and why a breach goes on the tracker as confirmed only when the organisation or a regulator says so.
How this is counted
Claims as collected from the gangs’ leak sites by ransomware.live, which says itself that they are unverified. We read its list every day and keep only counts: by month, by the victim’s country and by sector (as ransomware.live classifies them). Matches with official notices are by the organisation’s name, from 30 days before the claim to a year after it, against California’s and Washington’s full breach registers and every official notice on the tracker. A match is not a confirmation rate: those registers only see breaches of their own residents, and names are written differently. We never link to or visit leak sites.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.