California Golf Club of San Francisco targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: United States
• Sector: Hospitality
• Announcement date: October 7, 2025

The Qilin ransomware group has listed the California Golf Club of San Francisco on its leak site, claiming to have compromised the organization's data. This announcement, made on October 7, 2025, suggests that the hospitality sector organization has fallen victim to a targeted cyberattack by the threat actor.

The claimed attack and event details

According to the announcement made by the threat actor known as Qilin, the group targeted the California Golf Club of San Francisco. The group claims to have successfully breached the organization's systems and exfiltrated various files. While the announcement was posted on October 7, 2025, the group claims the attack itself took place on October 5, 2025.

In line with common ransomware tactics, the group has shared images of documents that allegedly belong to the organization to support their claims. Such actions are typical for ransomware groups that utilize a method known as double extortion. In this scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. If the victim refuses to pay the ransom, the attackers threaten to release the stolen data publicly to cause maximum reputational and legal damage.

The nature of the allegedly exfiltrated data

The group has not provided specific details regarding the exact content of the allegedly exfiltrated data. No information was provided regarding the total size of the data or the specific number of files taken. However, the screenshots shared by the group include visual samples that appear to be corporate documents and floor plans.

The listing names no specific data types in a structured format, but the visual evidence provided by the attackers points toward the presence of internal organizational documents and architectural or site layouts.

About the California Golf Club of San Francisco

Established in 1918, the California Golf Club of San Francisco is a private golf club located in South San Francisco. It operates a world-class golf course on a 425-acre site.

Potential risks and industry implications

This alleged data breach may pose a risk of exposure for the personal information of members and employees of the club. Because the organization is based in the United States, a potential data breach could trigger state-level privacy laws and relevant regulations. Organizations operating in the hospitality and private club sectors must remain vigilant, as such incidents can lead to significant reputational damage and increase the risk of secondary attacks, such as phishing or social engineering, targeting the members or staff.

When an organization is targeted by a group like Qilin, which is known for utilizing double-extortion tactics, the data might be publicly released if the organization does not pay the ransom. This creates a high-pressure situation for management. To defend against such threats, organizations typically implement layered security measures, including robust encryption, multi-factor authentication, and regular offline backups. Furthermore, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are essential steps for mitigating the impact of a potential breach.

Public information regarding the Qilin group remains limited, making it difficult to determine the full scope of their typical operations beyond these known tactics. As with any reported breach, the situation remains based on the claims made by the threat actor on their leak site.