Qilin ransomware group claims data breach at runaces.com

• Ransomware group: Qilin
• Country: United States
• Sector: Hospitality
• Announcement date: September 8, 2025

Qilin ransomware group claims data breach at runaces.com

The threat actor known as Qilin has listed runaces.com on its leak site, claiming to have conducted a ransomware attack against the organization. According to the announcement published on September 8, 2025, the group alleges that it has successfully gained access to the institution's systems and exfiltrated various data. This development suggests that the organization's operational data may be at risk following the claimed attack date of September 7, 2025.

Details of the claimed attack

The claim made by the Qilin group involves a breach where the threat actor asserts they have bypassed security measures to access internal systems. While the specific methods of entry were not detailed in the announcement, the group's presence on a leak site indicates a high-pressure tactic often used in modern cyber extortion. The announcement was made public on September 8, 2025, following the alleged intrusion.

The group has provided screenshots as evidence to support their claims of a successful exfiltration. These visual proofs are intended to demonstrate that the attackers have indeed accessed and moved sensitive information away from the target's network. Such tactics are characteristic of ransomware groups that utilize double extortion, a method where attackers not only encrypt an organization's data but also steal it to use as leverage during negotiations.

Data types allegedly exfiltrated

Based on the screenshots provided by the threat actor, several categories of sensitive information are claimed to have been stolen from the organization. The leaked information is said to include:

• Customer databases
• Accounting documents
• Player information

The nature of this data suggests a significant breach of privacy and operational security, as it encompasses both financial records and personal information belonging to the facility's clientele.

About running aces

Running Aces is a casino and racetrack located in Columbus, Minnesota. Opened in 2008, the facility offers various casino games, live horse racing events, and dining services.

Potential impact and industry implications

This incident may increase the risk of identity theft and financial fraud for the organization's customers and employees. Because the organization is based in the United States, the breach may trigger legal processes under relevant state laws and federal data privacy regulations. The use of double extortion by the Qilin group increases the likelihood that the exfiltrated data could be published or sold on the dark web.

Furthermore, the leaked data could serve as a basis for future targeted phishing attacks against the organization or its clients. The organization may also observe negative impacts on its operational continuity and reputation. In the hospitality and gaming sector, maintaining the trust of customers regarding their personal and financial information is critical for business stability.

In general, organizations facing such threats often look toward defensive strategies such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training. When a breach occurs, the focus typically shifts to incident response, forensic investigation, and compliance with regulatory notification requirements to mitigate long-term damage to reputation and legal standing.