Qilin

Active

2,242 victims named on the leak site

75 in the last 30 days

1,435 in the last 12 months

Oct 2022 first victim we recorded

Sep 29, 2026 most recent victim posted

15 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

21.5% of Qilin victims whose domain we can identify (482 of 2,242) had employee credentials leak in the 12 months before Qilin named them as a victim.

We don't know whether any of these credentials were how Qilin gained initial access.

What industries Qilin targets

Sector identified for 1,598 of 2,242 victims.

Manufacturing	360
Construction	191
Financial Services	181
Healthcare	177
Legal	98
Technology	83
Logistics	82
Education	80

Where the victims are located

Country identified for 1,705 of 2,242 victims.

United States	734
Canada	94
France	82
Germany	78
Spain	71
United Kingdom	70
Italy	62
Australia	39

Most recent Qilin victims

Victim	Sector	Country	Posted
Arnold Center arnoldcenter.org	Non-profit	United States	Sep 29, 2026
Nissho Denki Seisakusho nisshodenki.com	Manufacturing	Japan	Sep 29, 2026
New World Diagnostics nwdi.com.ph	Healthcare	Philippines	Sep 29, 2026
SK Logi sklg.co.jp	Logistics	Japan	Sep 29, 2026
Grupo Revenga gruporevenga.com	Telecommunications	Spain	Sep 28, 2026
Iberia Compositech Manufacturing iberiacompositech.com	Manufacturing	Spain	Sep 28, 2026
Island island.ca	Healthcare	Canada	Sep 28, 2026
Willatt & Flickinger wfaustin.com	Legal	United States	Sep 28, 2026
Xico Lighting xicoled.com	Manufacturing	United States	Sep 28, 2026
All Tech Machine & Engineering alltechinc.com	Manufacturing	United States	Sep 25, 2026
Coopérative Agricole Agora coopagora.fr	Agriculture	France	Sep 25, 2026
DAO Group daogroup.com	Not identified	United States	Sep 25, 2026
GDM gdmpipelines.com	Technology	Canada	Sep 25, 2026
Inversiones Bolívar inversionesbolivar.com	Real Estate	Not identified	Sep 25, 2026
Prospect Hill Camberwell prospecthillcamberwell.com.au	Not identified	Australia	Sep 25, 2026
Inkript inkript.com	Not identified	Not identified	Sep 24, 2026
Columbus Informatica columbusinformatica.it	Technology	Italy	Sep 23, 2026
Textile City textilecity.ca	Manufacturing	Canada	Sep 23, 2026
The Fifty/50 Group thefifty50.com	Hospitality	United States	Sep 23, 2026
Ikegami Tsushinki ikegami.co.jp	Manufacturing	Japan	Sep 22, 2026

Showing the 20 most recent of 2,242. Browse recent data breaches for more.

Qilin leak sites

Addresses we've seen Qilin publish victims from. Any .onion address needs the Tor Browser.

ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion
ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion
24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion
incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
kbsqoiyihadmwczmxkbovk7ss2dcynitwhhfu5yw725dbogo5kthfaad.onion
sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion
vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion
www.ransomlook.io
akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion
s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion
lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

Qilin questions

Is Qilin still active?

Yes. Qilin posted its most recent victim on September 29, 2026. That's 75 victims in the last 30 days.

How many victims has Qilin claimed?

Qilin has named 2,242 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 1,435 of them were posted in the last 12 months.

When did Qilin first appear?

The first victim we recorded for Qilin was posted on October 7, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Qilin target?

Manufacturing accounts for the most victims we can classify, with 360. Construction follows at 191. We could identify a sector for 1,598 of 2,242 victims, so treat this as the shape of the targeting rather than a full census.

Has Qilin already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.