Qilin, a ransomware operation that encrypts victim systems and names victims on a public leak site, leads 2026 disclosure counts while facing no arrest, sanction, or free decryptor. Response centers on patching exploited edge systems, while open questions concern victim scope and new September listings. The surge affects hospitals, suppliers, and any organization with exposed Cisco FMC or SonicWall SMA appliances. Leak counts show scale but do not confirm theft for any named company, so defenders need patching and triage more than speculation.
Table of Contents
- How large is the disclosure wave?
- Which flaws gave affiliates entry?
- What did the Synnovis review settle?
- What should exposed teams do now?
- How should readers handle new leak-site claims?
How large is the disclosure wave?
Adaptive Security reports Qilin claimed 1,358 victims between April 2025 and March 2026, up 443% year-over-year and about one in five publicly disclosed victims, in the Adaptive Security analysis. That pace kept Qilin at the top through summer.
Breachsense tracked 964 leak-site listings in August 2026, with Qilin leading at 157 victims across 78 countries. The spread across countries points to opportunistic targeting rather than one sector campaign. Security teams should treat Qilin as a high-volume threat, not a niche actor.
Which flaws gave affiliates entry?
Cisco Talos confirmed a Qilin affiliate exploited CVE-2026-20079, a CVSS 10.0 FMC authentication bypass that yields root, alongside Sandworm-linked clusters in August 2026, according to ZeroHunt summarizing Cisco Talos in the ZeroHunt summary of Cisco Talos findings. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Sept. 9 with a Sept.
12 federal patch deadline and forensics triage, per the Carthage Electronics CVE brief. A second chain hit VPN access. CISA and CyberPress reporting describe the SonicWall SMA 1000 pair CVE-2026-15409 and CVE-2026-15410 as weaponized as a zero-day from June 2026 and patched in mid-July 2026. Exposed FMC and SMA systems from those windows need urgent patching and log review.
What did the Synnovis review settle?
Synnovis finished its 18-month forensic review in November 2025 of its 2024 Qilin attack, then began notifying trusts, as reported by The Register in The Register report on the Synnovis probe. Reconstruction was exceptionally complex because stolen data was random and fragmented.
That limit explains the long timeline and phased notifications. PublicTechnology and Adaptive Security reporting put the impact at £32.7m, disruption across five NHS trusts, and 161,560 unentered pathology reports plus 122 safety incidents as of January 2026. The case shows how a supplier breach can create clinical backlog long after encryption ends.
What should exposed teams do now?
Adaptive Security notes Qilin.B encryption requires the attacker key, so exposed hosts cannot be recovered by decryption tools. Treat any FMC or SMA host unpatched during the exploit windows as compromised. Preserve logs before rebuilding and hunt for new accounts, tunnels, and credential use.
- Patch FMC against CVE-2026-20079 and SMA 1000 against CVE-2026-15409 and CVE-2026-15410.
- Isolate pre-patch hosts, capture images and logs, then rebuild and rotate credentials.
- Check VPN, firewall, and identity logs for bypass and lateral movement.
- Notify affected trusts, customers, or regulators once scope is clear.
How should readers handle new leak-site claims?
Undercode News citing ThreatMon lists Dao Group and All Tech Machine as Sept. 24 additions, in the Undercode News report on September listings. Continued entries show disclosure activity into late September.
A listing alone does not prove compromise or data theft. No arrest, sanction, joint government advisory, or free decryptor targeted Qilin as of August 2026, per Adaptive Security. Named firms should verify internally before assuming loss, and defenders should keep pre-patch systems isolated until cleared.
You Might Also Like
- Cybersecurity — ALPHV BlackCat Update 2026: Disclosure, Response, and Open Questions
- Cybersecurity — Credit Card Skimmer Update 2026: Disclosure, Response, and Open Questions
- Ransomware Attacks FAQ for September 2026: Source-Checked Answers to Common Questions