Thorndale Foundation listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Australia
• Announcement date: September 16, 2026

Qilin ransomware group claims data breach at Thorndale Foundation

The threat actor known as Qilin has claimed responsibility for a data breach targeting the Thorndale Foundation. On September 16, 2026, the group listed the organization on its dedicated leak site, alleging that they have successfully gained unauthorized access to the organization's internal systems. This announcement suggests a significant breach of confidentiality regarding the organization's digital environment.

According to the claims made by the Qilin group, the attackers managed to obtain various documents during their intrusion. To support their claims, the group has released several visual samples that are said to be related to the operations of the Thorndale Foundation. These samples serve as evidence for the group's assertion that they have successfully exfiltrated sensitive information from the target's infrastructure.

Details of the alleged data exfiltration

The information shared by the threat actor includes visual evidence of the stolen files. Based on the screenshots provided by the group, the leaked content appears to consist of several types of sensitive documentation. The visual samples show documents that resemble identification cards, which are highly sensitive pieces of information. Additionally, the screenshots include financial statements and various personnel records.

The specific types of data identified in the leak include:

• Identity information
• Financial records
• Personnel data

While the group has provided these visual samples, no specific information was provided regarding the total size of the data stolen or the exact file count. Furthermore, no ransom demand has been disclosed in the current announcement.

About the Thorndale Foundation

The Thorndale Foundation is an organization based in Victoria, Australia. It provides essential support services, education, and social inclusion programs specifically designed for individuals with disabilities. The primary mission of the foundation is to improve the quality of life for these individuals through the implementation of various community-based services.

Impact and security implications

This incident may result in the exposure of the organization's sensitive data to unauthorized third parties. The presence of identification and financial documents within the leaked samples suggests that the affected individuals may be exposed to significant risks, such as identity theft and fraud. Because the Qilin group utilizes a double-extortion methodology, secondary victimization may occur through the subsequent publication or sale of the stolen data on the dark web.

Under the Australian Privacy Act 1988, the organization may face specific data breach notification obligations. When organizations face such threats, it is often necessary to notify all affected parties regarding the exposure of their information. Furthermore, such incidents highlight the necessity for organizations to continuously review and strengthen their cybersecurity measures to prevent future unauthorized access and data exfiltration.

Ransomware leak sites function as a platform for threat actors to pressure victims by threatening to release stolen data. Double extortion is a common tactic where attackers not only encrypt an organization's data but also steal it, using the threat of public disclosure to increase the likelihood of receiving a ransom payment. This method places a heavy burden on organizations to manage both technical recovery and the legal and reputational consequences of a data leak.