Actor profile· ACT-006
Qilin
ActiveRansomware-as-a-serviceHealthcare and pathologyHigh severity
The operation behind the most consequential healthcare disruption in the corpus: the Synnovis pathology encryption at 24-0603, which cancelled around 10,000 appointments, and the publication that followed at 24-0624 when the NHS declined to pay.
12
Files naming the group
6
Sectors in the corpus
3
Jurisdictions
2024
Earliest file
Campaign timeline12 files
JUL 2026Check Point VPN appliances26-0705An authentication bypass on the appliance that decides who is inside. The intruder inherits every assumption built on it.NOV 2025BioPharma Services Inc.25-1127cTrial volunteers consented explicitly and specifically. The consent given did not contemplate this.NOV 2025Multiple sectors25-1128bKnowing this operation is active tells a defender nothing, because it is active everywhere. Naming it is naming the weather.NOV 2025South Korean asset managers25-1111bAn operator optimising for revenue keeps negotiations separate. Branding them together does the reverse.NOV 2025South Korean asset managers25-1110bYou can discover who your competitors bank with more readily than who runs their servers.NOV 2025Telecommunications sector25-1109An ecosystem-wide long tail alongside sector concentration. Both are true, and it complicates the corpus’s own argument.NOV 2025Ransomware ecosystem25-1108A fivefold rise is affiliate recruitment, not innovation. Which makes affiliate confidence the scarce asset worth attacking.NOV 2025Asahi Group Holdings25-1101Manual operation is not a degraded mode at reduced throughput. The throughput is what the software provides.JUN 2024Synnovis24-0624One paid and the data circulated anyway. One refused and the data was published. The suppression half delivered in neither case.JUN 2024Synnovis24-0610Universal donor blood exists for trauma, not for encrypted laboratories, and it happened to fit. That is luck rather than planning.JUN 2024Synnovis24-0604The standing objection to everything this database says about availability harm is that nobody can show it reaching a person. Here a trust did.JUN 2024Synnovis24-0603Those are not records lost. They are appointments that did not happen, to people who were already waiting.
© 2026 ForensicPost Media · the desk · newsletter · attribution policyGlossary