Qilin ransomware attacks in India
Qilin has posted 15 Indian organisations on its leak site since Sep 2024, 8 of them in the past 12 months, making it the 7th most active group in India over that period. The sector it hits most often in India is manufacturing.
15Indian victims posted, all time
8in the past 12 months
Sep 2024first Indian post
Aug 2026latest Indian post
Indian victims by month
Red bars are the past 12 months.
Sectors hit in India, all time
Indian victims by year
Where it comes from
Russia (evidence: strong)
US health-sector cyber agency assesses the group "likely originates from Russia"; its affiliate recruitment excludes CIS countries.
Sources: HHS HC3, Jun 2024. How evidence levels are judged: method.
Other gangs active in India
Leak-site counts from ransomware.live’s public data for victims with country India, as of 16 Oct 2026. A post is a claim made by a criminal group, not a confirmed breach, and the real number of attacks is higher. Victims are never named on this site. See the method.