Qilin

Active
2,190 victims named on the leak site
127 in the last 30 days
1,440 in the last 12 months
Oct 2022 first victim we recorded
Sep 14, 2026 most recent victim posted
14 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

21.6% of Qilin victims whose domain we can identify (474 of 2,190) had employee credentials leak in the 12 months before Qilin named them as a victim.

We don't know whether any of these credentials were how Qilin gained initial access.

What industries Qilin targets

Sector identified for 1,554 of 2,190 victims.

Manufacturing351
Construction188
Financial Services178
Healthcare174
Legal96
Education80
Technology79
Logistics76

Where the victims are located

Country identified for 1,657 of 2,190 victims.

United States721
Canada91
France81
Germany77
United Kingdom70
Spain64
Italy60
South Korea38

Most recent Qilin victims

VictimSectorCountryPosted
Caridro Val de Loire caridrovaldeloire.frManufacturingFranceSep 14, 2026
Gilco Scaffolding gilcoscaffolding.comNot identifiedUnited StatesSep 14, 2026
Imperial Healthcare Services imperialhcs.comHealthcareUnited StatesSep 14, 2026
Mitsuwa e-mitsuwa.comManufacturingJapanSep 10, 2026
Jet Specialty jetspecialty.comManufacturingUnited StatesSep 10, 2026
Alaska Joint Electrical Apprenticeship and Training Trust alaskaelectricalapprenticeship.orgNon-profitUnited StatesSep 9, 2026
JBC Soldering jbctools.comManufacturingSpainSep 8, 2026
Partners Group SK partnersgroup.skFinancial ServicesSlovakiaSep 8, 2026
AP Capital Partners apcapitalpartners.comFinancial ServicesUnited StatesSep 7, 2026
Bauman Law Group baumanlawgroup.comLegalUnited StatesSep 7, 2026
Big Table Group bigtablegroup.comHospitalityUnited KingdomSep 7, 2026
Colonial Hyundai colonialhyundai.comAutomotiveUnited StatesSep 7, 2026
G&S Technologies gstechnologies.comNot identifiedUnited StatesSep 7, 2026
Jouvet jouvet-sas.frNot identifiedFranceSep 7, 2026
Nolan Consulting Group nolancg.comNot identifiedUnited StatesSep 7, 2026
Philippine Ports Authority ppa.com.phGovernmentPhilippinesSep 7, 2026
Complete Packaging Solutions completepackaginggroup.comManufacturingUnited StatesSep 4, 2026
Grayson Rural Electric Cooperative graysonrecc.comNot identifiedUnited StatesSep 3, 2026
Tanner Servicios Financieros tanner.clFinancial ServicesChileSep 3, 2026
Usak University usak.edu.trEducationTurkeySep 3, 2026

Showing the 20 most recent of 2,190. Browse recent data breaches for more.

Qilin leak sites

Addresses we've seen Qilin publish victims from. Any .onion address needs the Tor Browser.

  • ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
  • kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion
  • ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion
  • 24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion
  • incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
  • kbsqoiyihadmwczmxkbovk7ss2dcynitwhhfu5yw725dbogo5kthfaad.onion
  • sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion
  • akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
  • cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion
  • vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
  • lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
  • ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion
  • www.ransomlook.io
  • s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion

Qilin questions

Is Qilin still active?

Yes. Qilin posted its most recent victim on September 14, 2026. That's 127 victims in the last 30 days.

How many victims has Qilin claimed?

Qilin has named 2,190 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 1,440 of them were posted in the last 12 months.

When did Qilin first appear?

The first victim we recorded for Qilin was posted on October 7, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Qilin target?

Manufacturing accounts for the most victims we can classify, with 351. Construction follows at 188. We could identify a sector for 1,554 of 2,190 victims, so treat this as the shape of the targeting rather than a full census.

Has Qilin already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.