Qilin Leads Surge in Ransomware Leak Claims Across Multiple Sectors
Forty-three unverified ransomware leak-site claims emerged in 24 hours, with Qilin posting the most assertions against US and other international targets.
Key points
- Qilin posted 12 of the 43 new ransomware leak-site claims recorded in a single 24-hour period.
- The United States faced the highest number of claims, with 16 assertions targeting organisations across that country.
- Manufacturing and technology sectors were equally targeted, each accounting for five of the reported claims.
A recent surge in ransomware activity saw criminal groups post 43 new leak-site claims within a 24-hour window, according to data desk analysis of public tracking information. These unverified statements represent assertions by threat actors that they have exfiltrated data and are demanding payment to avoid public release. The volume of claims highlights the persistent pressure on organisations to maintain robust backup and incident response capabilities.
How it unfolded
- Data desk analysis of the ransomware.live tracker identified 43 new leak-site claims posted over a 24-hour period.
- The Qilin ransomware group was the most active, accounting for 12 of the total claims recorded in this timeframe.
- Other groups with multiple assertions included Iah6477 and N0n, each posting six and five claims respectively.
Who is affected
The United States bore the brunt of this specific surge, with 16 claims directed at entities within its borders. The United Kingdom followed with three claims, while Egypt, Italy, Mexico and Brazil each saw two assertions. The data desk noted that victim names are deliberately withheld from these public trackers, preventing direct identification of the targeted organisations.
Sectoral analysis reveals that technology and manufacturing industries were the most frequently cited targets, each receiving five claims. Healthcare and professional services sectors also faced significant attention, with four claims each. The education sector accounted for three of the assertions. These figures represent the sectors named in the group claims, not confirmed breaches.
The fix
No software patch or technical update exists to reverse the impact of a ransomware leak-site claim, as these are assertions of exfiltration rather than a specific software vulnerability. The source material does not confirm whether any of the 43 groups have released data or accepted payments. Organisations should treat these claims as unverified until they receive direct communication from the threat actors or confirm data loss through internal forensic investigation.
What analysts watch for
Security teams usually monitor known ransomware leak sites for new entries matching their organisation’s name or indicators of compromise. Analysts examine the metadata of posted files to assess whether the data appears legitimate or staged. They also check internal logs for unusual outbound traffic or large data transfers that might correlate with the claimed exfiltration. Incident response plans should include procedures for verifying claim authenticity and assessing the potential impact of public data exposure on regulatory compliance.
Background: Incident response plans
Incident response plans reduce chaos during a crisis by defining roles and communication channels. However, they often create false security, encourage robotic compliance, and fail when attacks bypass standard detection. They are worth the effort only if treated as living frameworks rather than static documents.
Read the full guide: Incident Response Plans: Real Benefits and Hidden Costs
What to do and how to stay safe: Qilin
- Review current backup integrity to ensure clean copies exist outside the primary network environment.
- Monitor email inboxes and ticketing systems for any unexpected communications claiming data theft.
- Verify that endpoint detection tools are configured to alert on unusual data transfer volumes.
- Ensure incident response contacts are available to assess the validity of any external claims.
Step-by-step guide: Ransomware Incident Response: Steps to Contain and Recover
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware group posted the most claims in the last 24 hours?
According to the data desk analysis, the Qilin group posted the most claims, with a total of 12 assertions.
Which country faced the highest number of ransomware leak claims?
The United States faced the highest number of claims, with 16 assertions recorded in the 24-hour period.
Are the victim names publicly available in these leak-site claims?
No, the source material states that victim names are deliberately not reported in these public tracker entries.
