Qilin ransomware group lists www.newseason.com on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Healthcare
• Announcement date: May 1, 2025

The Qilin ransomware group has officially listed the healthcare provider www.newseason.com on its dedicated leak site. In the announcement, the threat actors claim to have successfully exfiltrated data belonging to the organization, marking a significant development in this ongoing cyber threat incident.

The claimed attack and group tactics

According to the post published by the Qilin group on May 1, 2025, the threat actors allege that they have successfully compromised the network of www.newseason.com. The group claims to have gained unauthorized access to the organization's internal systems, allowing them to exfiltrate sensitive information from the environment.

The nature of this announcement suggests that the group may be employing double-extortion tactics. In modern ransomware campaigns, double extortion involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information beforehand. The threat actor then threatens to leak this stolen data on a public leak site if the ransom demands are not met. This method is designed to increase the pressure on the victim organization by leveraging the potential reputational and legal consequences of a data exposure.

Data involved in the incident

While the group has made claims regarding the theft of information, they have not provided a detailed breakdown regarding the full scope or the specific content of the exfiltrated data. There is no information available regarding the total volume of data stolen or the specific file count. However, based on sample documents shared in screenshots provided by the group, the information appears to include operational and medical records belonging to the organization.

The listing specifically identifies the following types of affected data:

• Patient health records
• Medical service data

Organization profile

New Season is a healthcare organization that was founded in 1986. The company specializes in opioid addiction treatment and provides a variety of medical services, including medication-assisted treatment and counseling services.

Risk assessment and industry implications

This incident presents a significant risk due to the potential exposure of sensitive data belonging to a healthcare provider. If the alleged exfiltrated data includes patient privacy information, the organization may face legal and administrative sanctions under HIPAA regulations in the United States. The use of double-extortion methods by the Qilin group creates secondary risks, as the stolen data may be subsequently published or sold on the dark web.

For the patients of the organization, such a breach can lead to serious consequences, including identity theft and the risk of receiving targeted phishing attacks. Furthermore, the incident could lead to potential disruptions in the continuity of healthcare services, which may impact the overall operational reliability of the organization.

In the broader context of cybersecurity, organizations in the healthcare sector are frequent targets for ransomware groups due to the high value and sensitivity of medical records. To defend against such threats, organizations typically implement multi-layered security strategies. This includes maintaining robust backup solutions, implementing strict access controls, and conducting regular network monitoring to detect unauthorized access early. Furthermore, ensuring compliance with healthcare-specific regulations is a critical component of maintaining data integrity and patient trust.