Russian ransomware group Qilin has claimed responsibility for two major cyber-attacks targeting organisations in the US and Japan, cementing its place as one of the most prolific ransomware-as-a-service operations in the world.

In early September, the group claimed to have stolen 305 GB of sensitive data from Mecklenburg County Public Schools (MCPS) in southern Virginia. The files allegedly include financial records, grant documents, budgets and children’s medical information.

MCPS first reported the incident on 2 September, after a cyber-attack disrupted operations across the district. The breach forced teachers offline and led to a temporary suspension of digital systems, with lessons reverting to pen, paper and whiteboards. Internet access was restored roughly a week later.

Qilin later published sample images online which it said were part of the stolen material. Superintendent Scott Worner confirmed that the group was responsible for the attack but said the district was still determining the full extent of the breach.

“We don’t intend to move forward with payment at this time,” Worner said.

“The final decision depends on the findings of the investigation and what files were encrypted and/or stolen.”

He urged other school districts to review their cybersecurity posture, adding: “It’s not if. It’s when. Whoever your insurance company is, make sure your cybersecurity coverage is up to date.”

The incident is part of a wider trend of ransomware attacks targeting educational institutions. Data from Comparitech shows at least 33 confirmed ransomware attacks on American schools, colleges and universities in 2025, with another 62 claimed but unverified. The sector faces unique challenges in responding to breaches, taking an average of 4.8 months to notify affected individuals.

In September alone, school districts in Texas and Arizona disclosed new ransomware incidents, while Qilin has also claimed responsibility for attacks on Western New Mexico University, Botetourt County Public Schools in Virginia, Fort Smith Public Schools in Arkansas, and Belmont Christian College in Australia.

Qilin Expands Global Reach

Just weeks after the MCPS breach, Qilin claimed another high-profile victim: Japan’s Asahi Group. The gang listed the company on its data leak site on 7 October, alleging it had stolen 27 GB of files from the brewer.

According to Comparitech, the stolen data includes personal details of employees and sensitive business information such as financial documents, budgets, contracts, plans and development forecasts.

Asahi confirmed that it had suffered a ransomware attack which led to an “unauthorised transfer of data” from its servers. The incident caused significant operational disruption, forcing the suspension of order and shipment operations in Japan, along with the temporary closure of customer service desks and call centres.

The Tokyo-based firm – which owns global beer brands including Asahi, Peroni, Kozel, Pilsner Urquell and Grolsch, as well as UK-based brewery Fuller’s – said it is in the process of restoring operations through manual systems.

Asahi has not yet publicly responded to Qilin’s specific claims.

Qilin’s Growing Profile

Emerging in late 2022, Qilin operates as a ransomware-as-a-service (RaaS) network, renting out its malware and infrastructure to affiliates in exchange for a 15–20% share of ransom proceeds. Its malware, written in Rust and C, can target Windows, Linux and ESXi systems.

The group instructs affiliates not to target entities based in Commonwealth of Independent States (CIS) countries, including Russia and Belarus.

Qilin’s recent activity has made it one of the most prolific ransomware actors in 2025.

Recommended reading

• Are AI Chatbots Sending You to Phishing Sites?
• Deepfake Fraud Explodes 2,000% In Three Years
• Report: Dark Web Flooded with 500% Increase in Stolen Credentials

ZeroFox’s Q3 2025 Ransomware Roundup found that Qilin was responsible for the highest number of attacks in the quarter, with 227 incidents. NCC Group reported that Qilin accounted for 16% of all ransomware attacks in August, making it the most active threat group that month.

Comparitech data also links Qilin to three other confirmed ransomware attacks on Japanese companies this year — Shinko Plastics in June, Nissan Creative Box in August and Osaki Medical in August.

With more than 100 confirmed ransomware incidents and hundreds more unverified in 2025 alone, Qilin’s expanding global footprint highlights the increasing reach and sophistication of ransomware-as-a-service operations targeting both public and private sectors.