CoreHQ listed on Qilin ransomware leak site following claimed data breach

• Ransomware group: Qilin
• Country: United States
• Sector: Technology
• Announcement date: December 24, 2025

Qilin ransomware group targets CoreHQ

The Qilin ransomware group has officially listed the technology company CoreHQ on its dedicated leak site. Through this announcement, the threat actor group has claimed to have successfully executed a data breach against the organization. This development marks a significant escalation in the threat landscape facing the company, as the group has moved from the initial intrusion phase to publicizing the incident on their platform.

Details of the claimed incident

According to the information provided by the threat actor, the incident allegedly occurred on December 22, 2025. Following this purported intrusion, the Qilin group posted the organization's details on their leak platform on December 24, 2025. The group is currently employing a double-extortion tactic, a common method used by modern ransomware operations where the attackers not only encrypt systems but also threaten to publish sensitive organizational data to pressure the victim into paying a ransom.

Double-extortion tactics involve a multi-layered approach to coercion. By threatening to release stolen information to the public or specific stakeholders, attackers aim to create maximum reputational and legal pressure on the target. This method is particularly effective against organizations that handle sensitive information or those that rely heavily on public trust and regulatory compliance.

Data and evidence provided by the group

The listing includes a screenshot that displays blurred samples purportedly belonging to the documents that have been allegedly leaked. While these visual samples are intended to provide proof of the breach, the group has not provided any specific details regarding the exact nature or the specific scope of the leaked data. Consequently, there is currently no information available regarding the exact types of files or the volume of data involved in this incident.

Data details

• The listing names no specific data types.

About CoreHQ

CoreHQ is an open-source mobile data platform developed by Dimagi. The platform is specifically designed for data collection and program management in low-resource settings. It serves a global user base by digitizing and analyzing field data, particularly for projects involving health, agriculture, and humanitarian aid. Because of its specialized function, the platform is a critical tool for managing complex data in various international contexts.

Analysis and potential impact

The Qilin group is recognized as a Ransomware-as-a-Service (RaaS) operation that has been active since 2022. Their use of double-extortion tactics is a hallmark of their operational profile. Given that CoreHQ operates within the technology sector, this breach may increase supply chain risks and create the potential for secondary attacks targeting the organization's clients.

Furthermore, as the organization is based in the United States, the potential leak of data could trigger complex legal processes under federal regulations and state-level privacy laws. Such legal ramifications often follow data breaches involving US-based entities, requiring extensive forensic and legal investigations.

For organizations operating in similar sectors, this incident highlights the necessity of maintaining high levels of vigilance. Potential victims of such attacks may need to prepare for risks such as identity theft and targeted phishing attacks. Additionally, the group's past attack profile suggests that the publication of stolen data can have a significant negative impact on corporate reputation. To mitigate these risks, organizations generally focus on robust data encryption, strict access controls, and comprehensive incident response plans to defend against the evolving tactics of RaaS groups.