Loading story…
The Qilin ransomware operation claimed it breached Tennessee Valley Electric Cooperative (TVEC), an electric cooperative serving parts of West Tennessee, but provided no data samples on its leak site and TVEC had not publicly acknowledged the incident at the time of reporting. Based on Qilin’s prior activity against other U.S. electric cooperatives, the alleged theft could involve organizational data such as employee and customer information or internal documents, though the specific data allegedly taken from TVEC remains unverified.
Separately, ELECQ, a maker of smart EV chargers, notified customers that a ransomware attack hit parts of its AWS cloud environment, with some databases reportedly encrypted and copied, indicating potential data theft. ELECQ said exposed data was limited to customer contact details (names, emails, phone numbers, and home addresses), with no payment/credit-card data involved and no impact to the charging devices themselves; the company reported taking affected servers offline, restoring from backups, and hardening access controls (including disabling remote access services such as SSH and Telnet) while reporting the incident to regulators including the UK ICO and Germany’s BfDI.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Reporting on Qilin's recent activity also noted the group claimed to have stolen 222 GB of data from Spark Power, a Canada-based electrical services company with U.S. operations. The synopsis does not provide independent verification or a more specific date for the claim.
The Qilin ransomware operation purportedly listed Tennessee Valley Electric Cooperative on its leak site, claiming a breach of the U.S. electric cooperative. No proof-of-data samples were published, and TVEC had not publicly acknowledged the incident at the time of reporting.
As part of its response, ELECQ said it disabled remote access services such as SSH and Telnet and improved encryption measures. It also urged customers to reset passwords and remain alert for phishing attempts.
ELECQ notified customers that names, email addresses, phone numbers, and home addresses were exposed in the ransomware attack, while saying payment and credit card data and charging devices were not affected. The company also said it reported the incident to European regulators including the UK ICO and Germany’s Federal Commissioner for Data Protection and Freedom of Information.
After detecting the intrusion, ELECQ said it took affected servers offline and started incident response and recovery efforts, including restoring systems from backups. The company also engaged third-party cybersecurity specialists to support forensic investigation.
ELECQ said it identified unusual activity affecting its AWS cloud environment on March 7, 2026. The incident involved encryption of some databases and copying of data, indicating likely data theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Sep 1, 2026
The Qilin ransomware gang has claimed responsibility for significant cyberattacks against major North American organizations, including Canadian electrical services provider Spark Power and U.S.-based recruitment firm Cornerstone Staffing Solutions. In the Spark Power incident, Qilin alleges the theft of 222 GB of data, potentially including operational files, financial records, and employee personal information, with researchers warning of possible operational disruptions if systems are locked. For Cornerstone Staffing Solutions, Qilin claims to have exfiltrated 300 GB of sensitive data, including nearly 1 million files with resumes, personal records, Social Security numbers, and internal financial documents, with sample files leaked to substantiate the breach. Qilin has emerged as one of the most prolific ransomware operations, reportedly targeting nearly 1,000 organizations since 2023 and over 500 in the past six months alone. The group’s attacks have resulted in the exposure of sensitive employee and business data, raising concerns about the operational and reputational impact on affected organizations. These incidents highlight the ongoing threat posed by ransomware groups to critical infrastructure and service providers across North America.
Jun 29, 2026