What is Qilin, the ransomware network now targeting Belgian organisations?

Qilin is the name attached to a ransomware-as-a-service operation, also known in earlier reporting as Agenda. The core operators develop and maintain malicious software and an extortion platform, while affiliates conduct intrusions and share any proceeds. That structure means Qilin is better understood as a criminal network or brand than as one fixed team whose membership and location are conclusively known.

Once inside an organisation, Qilin-linked attackers can encrypt systems, steal files or combine both methods. The stolen material then becomes leverage: victims may be threatened with publication if they refuse to pay. Belgium’s Centre for Cybersecurity, or CCB, says this combination of encryption, data exfiltration and escalating pressure has made ransomware incidents more damaging even when the number of reported cases is relatively stable.

The CCB recorded 105 ransomware notifications in Belgium in 2025, compared with 109 in 2024. Its 2025 cyber-threat report identified Qilin, Akira and Clop among the active groups targeting Belgian organisations. It also assessed Qilin as a technically mature operator responsible for about 18% of claimed ransomware victims worldwide during 2025. A criminal group’s leak-site claim is not, however, independent proof that every alleged intrusion or stolen dataset is genuine.

Het Nieuwsblad reported that Qilin had entered the systems of 15 Belgian organisations in recent months before the WEBA incident. Separate threat-monitoring services also recorded a Qilin claim concerning Belgian travel company Connections in August, but no public technical evidence was available to verify the scale or method of that alleged intrusion. These distinctions matter: confirmed operational disruption, a criminal’s claim of responsibility and proof that particular customer records were stolen are three different things.

Qilin became internationally notorious after the June 2024 attack on Synnovis, a pathology provider serving several National Health Service hospitals in south-east London. NHS England says the attack severely reduced laboratory capacity, disrupted appointments and led to stolen files being published. Services were fully restored by December 2024.

The NHS subsequently recorded that a patient died unexpectedly during the disruption and that delayed blood-test results contributed to the death. That finding illustrates why ransomware is not merely an IT or privacy problem: when laboratories, retailers, logistics firms or public services lose access to essential systems, the consequences move rapidly into the physical world. British authorities and reporting linked Qilin to the Synnovis attack, although identifying individual perpetrators remains a law-enforcement challenge.

A breach at a familiar Belgian business can create a second wave of risk even before anyone knows exactly which records were taken. Criminals can use basic information—such as a name, email address, telephone number or knowledge of a recent purchase—to make a fraudulent message sound credible. A genuine-looking reference to a sofa delivery or unpaid balance does not prove that the sender is genuine.

If you receive such a message, do not use its link, attachment, telephone number or payment details. Open the retailer’s website yourself or call the store using a number from an invoice you already possess. Never disclose an itsme code, bank-card response code or password in response to an unsolicited request. Forward suspicious emails to [email protected]; in French-language guidance the same service is presented through Safeonweb’s “message suspect” pages. The federal portal is available in Dutch, French, German and English, which is useful for residents dealing with a gemeente or commune in a language other than their own.

Anyone who entered banking credentials should contact their bank immediately and call Card Stop on 078 170 170 if a payment card may be compromised. Change any exposed password, starting with the associated email account, and do not reuse it elsewhere. If money has been taken or there has been an extortion attempt, preserve messages, payment information and screenshots, then report the matter to your local police zone. The Federal Police advises ransomware victims to make a statement at the local police service; residents can find the appropriate zone by postcode through Police.be.

For a compromised home or work device, Safeonweb recommends disconnecting Wi-Fi or the network cable and removing external drives to limit further spread. Organisations should alert their IT or security lead, isolate affected systems, preserve evidence and use a separate communication channel. Both Safeonweb and the CCB advise against paying: payment provides no assurance that files will be restored, stolen data deleted or access routes closed. Decryption tools for some ransomware families are available through the international No More Ransom project.

Qilin’s prominence reflects an industrialised cybercrime market. Malware developers, access brokers and intrusion specialists can work as separate suppliers, allowing an operation to continue even when one affiliate or server is removed. The fall of LockBit did not end ransomware; according to the CCB, it produced a more fragmented environment in which several groups compete for victims.

Belgium is not among Europe’s most-targeted countries in absolute terms, the CCB says, but its retailers, healthcare providers, logistics businesses and multilingual customer databases remain attractive. The risk is national rather than confined to one region: a company may serve Dutch-speaking customers through a gemeente, French-speaking residents through a commune and international clients in English while relying on the same interconnected systems.

WEBA’s investigation and any legally required notifications should clarify whether personal information was extracted and which people, if any, need to take further action. Until then, customers should avoid assuming either that their data was stolen or that silence proves it was safe. The most useful response is measured vigilance: verify unusual requests, secure reused passwords and rely on updates from WEBA, the CCB, Safeonweb and the police rather than screenshots or claims circulating on social media.