Qilin ransomware hit 53 organisations in Japan; Germany arrests man detained in Osaka
In short
The ransomware group Qilin, to which a 28-year-old Russian national detained in Japan and handed over to Germany belongs, has caused damage at 53 companies and other organisations in Japan, the National Police Agency said on October 8. German authorities have arrested the man, who was detained at a hotel in Osaka in May and extradited in October. The group has been active since around October 2022 and its victims are put at about 4,000 companies worldwide.
Read the full story 2 min read
Damage caused by the ransomware group Qilin has been confirmed at 53 companies and other organisations in Japan, the National Police Agency said on October 8. The group goes by several names in Japanese, including "Kirin" and "Kiirin", according to the agency. A 28-year-old Russian national who belongs to the group was detained in Japan and handed over to Germany, where authorities have arrested him. [ 1 , 2 , 3 , 5 , 6 ]
According to the agency, Qilin began operating around October 2022 and about 4,000 companies worldwide have been hit; several outlets describe the global figure as an estimate. In Japan, damage has been confirmed since April 2023. Asahi Shimbun reported that the 53 cases in Japan ran from April 2023 to the end of September this year and include companies, schools and hospitals. [ 1 , 2 , 3 , 5 , 6 ]
The agency has not named the 53 victims, but they span manufacturing, services, construction, hospitals and schools. The 2025 damage at Asahi Group Holdings is believed to be among them, according to several outlets. [ 2 , 3 , 6 ]
German authorities requested the man's detention under Japan's extradition law. Asahi Shimbun reported that German investigators had obtained an arrest warrant over ransomware attacks on German companies, and that the National Police Agency's Cyber Special Investigation Unit learned in advance that he would visit Japan. A joint investigation with the Tokyo Metropolitan Police Department and the Osaka and Kyoto prefectural police found him staying at a hotel in Osaka, and he was detained in May while visiting Japan as a tourist. He was handed over to Germany in October. [ 2 , 3 , 5 , 6 ]
Asahi Shimbun reported that, according to the agency, Qilin has core members who develop the malware and multiple affiliates who break into companies and carry out the attacks, and that the man was one of the core members. The group encrypts data and demands a ransom for its recovery, and also threatens to publish data on a leak site. The agency said it hopes the damage in Japan will also be clarified by further investigation. [ 5 ]
Why it matters
The case links a single ransomware group to damage across manufacturing, services, construction, hospitals and schools in Japan, and, according to several outlets, likely to the 2025 attack on Asahi Group Holdings. It also shows Japanese and German authorities working together through Japan's extradition law. The National Police Agency said it hopes further investigation will clarify the damage in Japan.
Key facts
- Damage by the ransomware group Qilin has been confirmed at 53 companies and other organisations in Japan, according to the National Police Agency. [ 1 , 2 , 3 , 5 , 6 ]
- The group began operating around October 2022 and is put at about 4,000 victim companies worldwide; in Japan, damage has been confirmed since April 2023. [ 1 , 2 , 3 , 5 , 6 ]
- A 28-year-old Russian national said to belong to the group was detained by Japanese authorities at a hotel in Osaka in May and handed over to Germany in October. [ 2 , 3 , 5 , 6 ]
- German authorities have arrested the man. [ 2 , 3 , 4 , 5 , 6 ]
- Victims span manufacturing, services, construction, hospitals and schools; the National Police Agency has not named the 53. [ 2 , 3 , 5 , 6 ]
- The 2025 damage at Asahi Group Holdings is believed to be among the cases. [ 2 , 3 , 6 ]
- The detention involved the National Police Agency's Cyber Special Investigation Unit, the Tokyo Metropolitan Police Department and the Kyoto and Osaka prefectural police. [ 2 , 3 , 5 , 6 ]
Confirmed by several sources
- Qilin ransomware damage has been confirmed at 53 organisations in Japan, according to the National Police Agency. [ 1 , 2 , 3 , 5 , 6 ]
- Qilin began operating around October 2022 and its worldwide victims number about 4,000 companies. [ 1 , 2 , 3 , 5 , 6 ]
- The 28-year-old Russian man was detained at a hotel in Osaka in May and handed over to Germany in October. [ 2 , 3 , 5 , 6 ]
- German authorities have arrested the man. [ 2 , 3 , 5 , 6 ]
- The handover to Germany was made under Japan's extradition law. [ 2 , 3 , 5 , 6 ]
Still unclear
- Which 53 organisations in Japan were affected. The National Police Agency has not disclosed them.
- Whether the 2025 damage at Asahi Group Holdings is among the 53 cases. Outlets say it is believed to be included, without confirmation.
- The man's role in the group. Only Asahi Shimbun reports, citing the National Police Agency, that he was one of the core members who develop the malware.
- The figure of about 4,000 victims worldwide. Several outlets describe it as an estimate.
What local media are saying
Timeline, local time
- Oct 8: Sankei Shimbun reports Qilin damage at 53 companies in Japan. [ 1 ]
- Oct 8: Livedoor News reports German authorities have arrested the extradited man. [ 2 ]
- Oct 8: Tokyo Shimbun publishes the same report. [ 3 ]
- Oct 8: Nishi-Nippon Shimbun runs the report. [ 4 ]
- Oct 8: Asahi Shimbun reports the man was a core member of the group. [ 5 ]
- Oct 9: Nikkei reports the 53 victims and the arrest in Germany. [ 6 ]