Ransomware gang Qilin steals data from Scientology

The criminal online association Qilin reports an IT break-in with data theft at Scientology. More precise information is still missing, but some screenshots of documents with personal and sensitive information are said to prove this.

The Ransomware-as-a-Service group Qilin (Overview by Check Point) typically uses "double extortion." On the one hand, the ransomware encrypts the victims' data. On the other hand, the gang copies the data and offers it for sale on the darknet – whoever pays first "wins," be it the victim or competitors.

The screenshots of some stolen documents presented on Qilin's darknet leak site indicate that the cyber gang has infiltrated the IT systems in the United Kingdom of the Scientology organization, which is monitored by the constitutional protection authorities of several federal states. Approvals of costs for UK visas are found there, but also lists of members along with account balances and their level within the organization – which are not limited to England but include people from South America, for example.

Impact unclear

The amount of any ransom demand, for example, is not found on Qilin's darknet site. It is unclear how Scientology will react. The publication of information about members or victims of the organization could harm it. Investigators and observers are also likely to be interested in the data.

Qilin is one of the most active cyber gangs, responsible for many break-ins, including into renowned companies. It is behind the attack on the Japanese Asahi brewery, which led to beer supply shortages. However, the Ransomware-as-a-Service gang even goes over dead bodies: following a cyberattack on the NHS England, there was a death because blood test results could not be transmitted in time.

(dmk)