Qilin 2026 activity
Ransomware group. 39 reports in 14 countries: 3 confirmed, 36 claimed or disputed. Latest 7 Nov 2026.
Singapore · 
Malaysia · 
Chile · 
Philippines · 
Myanmar · 
Bangladesh · 
Thailand · 
Mexico · 
Argentina · 
Pakistan · 
Vietnam · 
New Zealand · 
Germany · 
Romania
🎯 What sources say
- Malaysia: Listed Malaysia Airlines, PLUS, Omesti, Lam Soon, Kerjaya Prospek, Kontena Nasional, MP Alor Gajah, PNSB Insurance Brokers, Sunway, CareClinics, Pengurusan Aset Air and Astino in 2026, and was the top variant in MyCERT's Q4 2025 count. ransomware.live Malaysia MyCERT SR-033.042026
- Singapore: Listed Singapore victims including Neo Group, Pleiad Investment Advisors and One Legal in 2026. ransomware.live ransomware.live
- Thailand: Listed Isuzu Motors Thailand, STOU and several Thai firms in 2026. ransomware.live Thailand
- Philippines: Most active ransomware group against Philippine firms in 2026, listing PSBank, Megawide, Philex Mining and Globalport Terminals. Ransomware.live (Philippines) Cyber Security Asia (Check Point report)
- Vietnam: Listed Vietnam Airlines in January 2026 and a Vietnamese construction consultancy in June 2026; Viettel names it among double-extortion groups hitting Vietnam in Q3. ransomware.live Thanh Nien Viet
- Romania: Claimed the Conpet attack in February 2026. The Record
- Germany: Claimed the March 2026 attack on Die Linke; Germany arrested a suspected core member in October 2026. BleepingComputer
- Mexico: The most frequent group on leak-site posts naming Mexican victims in 2026. ransomware.live
- Argentina: The most frequent group on leak-site posts naming Argentine victims in 2026. ransomware.live
- Chile: The most frequent group on leak-site posts naming Chilean victims in 2026. ransomware.live
- Colombia: The most frequent group on leak-site posts naming Colombian victims in 2026. ransomware.live
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
| ⚠️ ClaimedBOSH Engineering Private Limited | Singapore | 7 Nov 2026 | Manufacturing | Ransomware | Qilin | Claimed. Qilin listed the Singapore engineering firm on its leak site on 7 November. No data volume stated and no press coverage found. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedAstino | Malaysia | 2 Nov 2026 | Manufacturing | Ransomware | Qilin | Claimed. Qilin listed Astino Berhad on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedIsapre Consalud | Chile | 2 Nov 2026 | Health | Ransomware | Qilin | Claimed. Qilin listed the health insurer on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedLight Rail Manila (LRT-1) | Philippines | 30 Oct 2026 | Transport | Ransomware | Qilin | Claimed. Listed on Qilin's leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedOoredoo Myanmar (Nine Communications) | Myanmar | 25 Oct 2026 | Telecom | Ransomware | Qilin | Claimed. Qilin listed Ooredoo Myanmar on its leak site. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedLabaid Cancer Hospital and Super Speciality Centre | Bangladesh | 23 Oct 2026 | Health | Ransomware | Qilin | Claimed. Qilin listed the hospital on its leak site. No statement from the hospital was found. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedPengurusan Aset Air Bhd | Malaysia | 18 Oct 2026 | Government | Ransomware | Qilin | Claimed. Listed on Qilin's leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedThai Lion Air | Thailand | 2 Oct 2026 | Transport | Ransomware | Qilin | Claimed. Listed on Qilin's leak site with a threat to publish data. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPhilippine Ports Authority | Philippines | 5 Sep 2026 | Transport | Ransomware | Qilin | Claimed. Listed on Qilin's leak site; not confirmed by the PPA. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedCareClinics | Malaysia | 29 Aug 2026 | Health | Ransomware | Qilin | Claimed. Qilin listed the CareClinics primary care network on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedGlobalport Terminals | Philippines | 27 Aug 2026 | Transport | Ransomware | Qilin | Claimed. Qilin listed Globalport Terminals on its leak site on 27 August. | Ransomware.live (Philippines)✓ 7 Nov |
 ⚠️ ClaimedCinépolis | Mexico | 21 Aug 2026 | Other | Ransomware | Qilin | Claimed. Qilin listed the cinema chain on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMegawide Construction | Philippines | 16 Aug 2026 | Property | Ransomware | Qilin | Claimed. Qilin listed Megawide on its leak site on 16 August. | Ransomware.live (Philippines) · DeXpose✓ 7 Nov |
 ⚠️ ClaimedEjército Argentino | Argentina | 24 Jul 2026 | Government | Ransomware | Qilin | Claimed. Qilin listed the Argentine Army on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedSunway BerhadSelangor | Malaysia | 23 Jul 2026 | Property | Ransomware | Qilin | Claimed. Qilin listed Sunway Berhad (sunway.com.my) on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedEFU Life Assurance | Pakistan | 22 Jul 2026 | Finance | Ransomware | Qilin | Claimed. Qilin listed the insurer on its leak site and threatened to publish data unless it negotiated. | DeXpose · ransomware.live✓ 8 Nov |
 ⚠️ ClaimedConstruction consulting JSC (name garbled on leak site) | Vietnam | 15 Jun 2026 | Property | Ransomware | Qilin | Claimed. Qilin listed a Vietnamese general construction consulting joint stock company on 15 June 2026; the tracker shows the name with Vietnamese characters stripped. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedIsuzu Motors (Thailand) | Thailand | 8 Jun 2026 | Manufacturing | Ransomware | Qilin | Claimed. Qilin listed Isuzu Motors (isuzu-motors.co.th) on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedAlpha Group Holdings | New Zealand | 24 May 2026 | Manufacturing | Ransomware | Qilin | Claimed. Qilin listed the Auckland health supplements maker on its leak site on 24 May without publishing any data samples. | Insurance Business NZ✓ 8 Nov |
 ⚠️ ClaimedMajlis Perbandaran Alor GajahMelaka | Malaysia | 17 May 2026 | Government | Ransomware | Qilin | Claimed. Qilin listed the Alor Gajah municipal council on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPNSB Insurance Brokers | Malaysia | 17 May 2026 | Finance | Ransomware | Qilin | Claimed. Qilin listed PNSB Insurance Brokers Sdn Bhd on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedOne Legal | Singapore | 13 May 2026 | Other | Ransomware | Qilin | Claimed. The Qilin group listed One Legal on its leak site on 2026-05-13. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPhilex Mining | Philippines | 30 Apr 2026 | Other | Ransomware | Qilin | Claimed. Qilin listed Philex Mining on its leak site on 30 April. | Ransomware.live (Philippines)✓ 7 Nov |
 ✅ ConfirmedShwapno (ACI Logistics) | Bangladesh | 28 Mar 2026 | Retail | Ransomware | Qilin | Confirmed. Shwapno said hackers breached its customer database and demanded $1.5 million. It is working with forensic experts and the police CTTC unit. Claimed. Qilin listed Shwapno on its leak site on 17 March 2026. | The Business Standard · ransomware.live✓ 8 Nov |
| ⚠️ ClaimedKerjaya Prospek Group | Malaysia | 27 Mar 2026 | Property | Ransomware | Qilin | Claimed. Qilin listed Kerjaya Prospek Group on its leak site. | ransomware.live✓ 7 Nov |
 ✅ ConfirmedDie Linke | Germany | 27 Mar 2026 | Other | Ransomware | Qilin | Confirmed. The party disclosed a cyber incident, said attackers aimed to publish internal data and staff details, and filed a criminal complaint. Claimed. Qilin listed Die Linke on its leak site on 1 April 2026. | BleepingComputer✓ 7 Nov |
| ⚠️ ClaimedPleiad Investment Advisors (Singapore branch) | Singapore | 9 Mar 2026 | Finance | Ransomware | Qilin | Claimed. The Qilin group listed Pleiad Investment Advisors (Singapore branch) on its leak site on 2026-03-09. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedOmesti | Malaysia | 3 Mar 2026 | Other | Ransomware | Qilin | Claimed. Qilin listed Omesti Berhad on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedLam Soon Group | Malaysia | 3 Mar 2026 | Manufacturing | Ransomware | Qilin | Claimed. Qilin listed Lam Soon Group on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMalaysia AirlinesSelangor | Malaysia | 26 Feb 2026 | Transport | Ransomware | Qilin | Claimed. Qilin listed Malaysia Airlines on its leak site without data samples, separate from the later Amadeus incident. | ransomware.live · SC Media✓ 7 Nov |
 ⚠️ ClaimedMunicipio de Chihuahua | Mexico | 7 Feb 2026 | Government | Ransomware | Qilin | Claimed. Qilin listed the Chihuahua municipal government on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedPLUS MalaysiaSelangor | Malaysia | 6 Feb 2026 | Transport | Ransomware | The Gentlemen · Qilin | Claimed. The Gentlemen listed the highway operator on 6 February and Qilin listed it again on 1 March. | ransomware.live (The Gentlemen) · ransomware.live (Qilin)✓ 7 Nov |
| ✅ ConfirmedConpet | Romania | 4 Feb 2026 | Energy | Ransomware | Qilin | Confirmed. Conpet, the national oil pipeline operator, confirmed a cyberattack on parts of its IT and said oil transport and SCADA systems were not affected. Claimed. Qilin listed Conpet on its leak site and claimed nearly 1 TB of data. | The Record✓ 7 Nov |
 ⚠️ ClaimedPhilippine Savings Bank (PSBank) | Philippines | 28 Jan 2026 | Finance | Ransomware | Qilin | Claimed. Qilin listed PSBank on its leak site on 28 January; The Gentlemen listed it again on 1 August. | Ransomware.live · Deep Web Konek✓ 7 Nov |
 ⚠️ ClaimedSukhothai Thammathirat Open University | Thailand | 27 Jan 2026 | Education | Ransomware | Qilin | Claimed. Qilin listed STOU (stou.ac.th) on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedKontena Nasional | Malaysia | 20 Jan 2026 | Transport | Ransomware | Qilin · The Gentlemen | Claimed. Qilin and The Gentlemen each listed Kontena Nasional Berhad on their leak sites on the same day. | ransomware.live (Qilin) · ransomware.live (The Gentlemen)✓ 7 Nov |
 ⚠️ ClaimedVietnam Airlines | Vietnam | 18 Jan 2026 | Transport | Ransomware | Qilin | Claimed. Qilin listed Vietnam Airlines on its leak site on 18 January 2026 and threatened to publish data unless the airline negotiated. | ransomware.live · DeXpose✓ 7 Nov |
 ⚠️ ClaimedNeo Group | Singapore | 15 Jan 2026 | Retail | Ransomware | Qilin | Claimed. The Qilin group listed Neo Group on its leak site on 2026-01-15. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedFarmacia San Pablo | Mexico | 2 Jan 2026 | Retail | Ransomware | Qilin | Claimed. Qilin listed the pharmacy chain on its leak site with no proof attached. No company statement found. | Botcrawl✓ 8 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology