Centro Científico e Cultural de Macau targeted by qilin ransomware group

• Ransomware group: qilin
• Country: Portugal
• Sector: Education
• Announcement date: July 13, 2026

The Centro Científico e Cultural de Macau has been listed on a ransomware leak site by the qilin group. The threat actor claims to have successfully compromised the institution's data, marking a potential significant breach for the Portuguese organization.

The claimed attack and event details

According to the announcement published on July 13, 2026, the qilin group has officially listed the Centro Científico e Cultural de Macau on its dedicated leak site. The group alleges that they have gained unauthorized access to the institution's systems and has claimed a data breach has occurred. The announcement was made on the same day as the claimed attack date, July 13, 2026.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By publishing the names of organizations they have targeted, these groups aim to damage the reputation of the victim and increase the likelihood of a ransom payment. In this instance, the qilin group is using its platform to signal that the Centro Científico e Cultural de Macau is a target of their operations.

Information regarding the leaked data

At this stage, there is no information available regarding the nature of the leaked or threatened data. The group has not provided any specific details concerning the types of files, the volume of information, or the specific databases that may have been accessed. Furthermore, no screenshots of the stolen data have been provided by the threat actor to substantiate their claims.

• No specific data types were listed in the announcement.

The organization profile

The Centro Científico e Cultural de Macau (CCCM) is a public institution operating under the Portuguese Ministry of Science, Technology and Higher Education. The center serves a specialized role as a research and cultural hub. Its primary mission is dedicated to promoting scientific, cultural, and academic relations between Macau, China, and Portugal.

Risk assessment and organizational implications

This incident may pose a risk of exposing the institution's sensitive data. If a data breach has indeed occurred, several secondary risks may emerge. These include the potential for identity theft or the execution of targeted phishing attacks against the institution's employees and students. Such attacks often leverage stolen credentials or personal information to gain further access to internal systems or to defraud individuals.

Because the institution is based in Portugal, the situation may trigger specific legal obligations. Compliance processes and legal sanctions under the GDPR (EU General Data Protection Regulation) may be applicable depending on the nature of the data involved. Organizations operating within the European Union must adhere to strict protocols regarding the protection of personal data and the notification of breaches to the relevant authorities.

The qilin group is known to employ double extortion tactics. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to threaten its public release. This dual approach is designed to maximize pressure on the victim to pay a ransom to prevent the publication of their data. While information about the qilin group remains limited, their use of such tactics is a common trend in modern ransomware operations.

For organizations in the education and research sector, maintaining robust cybersecurity posture is essential. Defensive measures typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Given the sensitive nature of academic and scientific research, protecting the integrity and confidentiality of data is a primary concern for institutions like the CCCM.