Loading story…
The Qilin ransomware operation claimed responsibility for compromising the Augusta Housing Authority (AHA) in Georgia and published sample files allegedly stolen from the agency, including internal correspondence, financial/expense documents, and spreadsheets containing sensitive personal information (e.g., utility reimbursement recipient data and employee benefits deductions). AHA had not publicly confirmed the intrusion, but reported ongoing efforts to restore website functionality amid access issues; reporting also notes Qilin’s high operational tempo in early 2026, with numerous claimed victims across sectors.
Separately, a Georgia-based healthcare provider group, ApolloMD, reported to U.S. regulators that a 2025 intrusion exposed data for 626,540 individuals, including SSNs and medical/insurance information; ApolloMD said attackers accessed its IT environment over a short window in May 2025, and Qilin publicly claimed the attack in June 2025. A third report about Conduent’s 2025 ransomware incident (impact estimates rising to ~25 million) describes a different victim and event and is not part of the Qilin/Georgia victim reporting described above.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Qilin published four sample datasets it said were taken from the Augusta Housing Authority, including tax-related correspondence, a December 2025 utility reimbursement report, a 2023 expense sheet, and employee benefits payroll information. Cybernews researchers said the samples contained sensitive data.
The Augusta Housing Authority said it was working to restore website functionality amid access issues, around the time Qilin alleged it had compromised the organization. The authority had not publicly acknowledged the ransomware gang's breach claim.
ApolloMD submitted a subsequent filing to the U.S. Department of Health and Human Services reporting that 626,540 people were affected by the 2025 attack. This updated federal disclosure provided the full victim count after the company's earlier September notification.
ApolloMD initially disclosed the incident and notified affected individuals in September 2025. At that stage, the company said the May attack had compromised sensitive personal and protected health information.
In June 2025, the Qilin ransomware gang claimed the cyberattack against ApolloMD. The group was later linked in reporting to the theft of sensitive patient data from the healthcare company.
ApolloMD said attackers were present in its IT environment between 2025-05-22 and 2025-05-23, accessing patient-related information tied to ApolloMD-affiliated physicians and practices. The exposed data included personal and medical information, health insurance data, and Social Security numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Sep 1, 2026
The Qilin ransomware gang has claimed responsibility for significant cyberattacks against major North American organizations, including Canadian electrical services provider Spark Power and U.S.-based recruitment firm Cornerstone Staffing Solutions. In the Spark Power incident, Qilin alleges the theft of 222 GB of data, potentially including operational files, financial records, and employee personal information, with researchers warning of possible operational disruptions if systems are locked. For Cornerstone Staffing Solutions, Qilin claims to have exfiltrated 300 GB of sensitive data, including nearly 1 million files with resumes, personal records, Social Security numbers, and internal financial documents, with sample files leaked to substantiate the breach. Qilin has emerged as one of the most prolific ransomware operations, reportedly targeting nearly 1,000 organizations since 2023 and over 500 in the past six months alone. The group’s attacks have resulted in the exposure of sensitive employee and business data, raising concerns about the operational and reputational impact on affected organizations. These incidents highlight the ongoing threat posed by ransomware groups to critical infrastructure and service providers across North America.
Jun 29, 2026