Qilin ransomware group lists www.waveny.org on its leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Healthcare
• Announcement date: June 12, 2025

The Qilin ransomware group has listed the United States-based healthcare organization Waveny on its dedicated leak site. The threat actors claim to have successfully exfiltrated data belonging to the institution, marking a new incident involving the group's ongoing targeting of various sectors.

The claimed attack and extortion method

According to the announcement made on the group's leak platform on June 12, 2025, the Qilin ransomware group claims to have gained unauthorized access to the systems of Waveny on June 5, 2025. This timeline suggests that the threat actors maintained presence within the network for several days prior to the public disclosure of the breach.

The group continues to utilize double extortion tactics in its operations. In a double extortion scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption phase. By threatening to publish this stolen data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This method increases the pressure on organizations, as the threat of a data leak remains even if the organization can restore its systems from backups.

Potential data exposure and contents

While the full scope and volume of the leaked data have not been specified by the group, the available evidence suggests a significant breach of information. Screenshots provided by the threat actors display numerous examples of documents that appear to be related to the organization's administrative and operational processes. These images include various tables, forms, and documents that reflect the internal workings of the institution.

The data identified in the leak may include the following:

• Personally identifiable information
• Corporate operational documents

The presence of such documents indicates that the breach may involve sensitive details regarding the organization's internal management and potentially the private information of individuals associated with the entity.

Risk assessment and sector implications

This leak may pose a significant risk due to the potential exposure of personal data belonging to patients and employees. For an organization operating within the healthcare sector, such breaches carry heavy implications. Specifically, potential data breaches may lead to legal sanctions under HIPAA regulations, which govern the protection of sensitive patient health information.

The use of the double extortion method by the Qilin group increases the likelihood of the organization being subjected to secondary attacks. These secondary threats often include identity theft and highly targeted phishing attempts aimed at individuals whose data was compromised. Furthermore, the leaked data may have negative implications for supply chain security, as compromised information can be used to target partners or vendors connected to the primary organization.

The Qilin group has demonstrated a pattern of targeting the healthcare sector since 2022. This history of activity suggests that the organization's operational continuity may remain at long-term risk. To defend against such threats, organizations in this sector typically focus on robust access controls, continuous monitoring of network traffic, and comprehensive employee training to recognize phishing attempts. Strengthening incident response plans and maintaining offline, immutable backups are also critical defensive steps for mitigating the impact of ransomware and data exfiltration events.