The Holiday:Adult Care Community & Retirement Homes targeted by Qilin ransomware

• Ransomware group: Qilin
• Country: United States
• Sector: Healthcare
• Announcement date: May 21, 2025

Qilin ransomware group claims attack on healthcare provider

The threat actor known as Qilin has listed The Holiday:Adult Care Community & Retirement Homes on its leak site, alleging a ransomware attack against the organization. This announcement, made on May 21, 2025, indicates that the group intends to publish the victim's data. According to the claim, the stolen information will be made available for download on May 29, 2025.

Qilin is a ransomware group that has been active since 2022. The group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. In such scenarios, if a victim refuses to pay the ransom to decrypt their files, the attackers threaten to leak the stolen information on a public leak site to pressure the organization into compliance.

Details of the alleged data breach

The specific nature of the data involved in this incident remains unclear. While the group has claimed responsibility for the attack, the provided documentation does not specify the exact types of files or the volume of information that has been compromised. The text in the provided screenshot is blurred, which prevents a detailed identification of the specific data types that may have been targeted during the breach.

The listing names no specific data types.

Organizational profile

The Holiday:Adult Care Community & Retirement Homes, specifically identified through the Holiday Skilled Nursing and Rehabilitation Center, is a family-owned nursing and rehabilitation facility. It has been serving Northern Rhode Island since 1973 and specializes in adult care and retirement home services.

Potential impact and industry implications

Because the targeted institution operates within the healthcare sector, there is a significant possibility that the alleged leaked data may contain sensitive personal records and patient privacy information. Such a breach carries heavy implications for healthcare providers. In the United States, the exposure of protected health information can lead to legal sanctions under HIPAA regulations and can result in significant reputational damage for the organization involved.

The use of double-extortion tactics by Qilin introduces secondary risks that persist even if systems are restored. Once the data is published on a leak site, it can be used for identity theft and targeted phishing attacks against both the organization and its patients. Furthermore, any disruption to the operational processes of a healthcare provider can have negative impacts on patient care, as these facilities rely on continuous access to records and digital systems to maintain safety and service standards.

The group's past activities indicate a clear tendency to target the healthcare sector, a trend that highlights the ongoing risks faced by medical and care facilities. To defend against such threats, organizations in this sector often implement defensive measures such as robust data encryption, strict access controls, regular offline backups, and comprehensive employee training to recognize phishing attempts. Given the sensitivity of healthcare data, maintaining high standards of cybersecurity is critical to preventing both operational downtime and the unauthorized disclosure of private information.