Qilin Ransomware Group Targets Melbourne-Based Branded Products in Latest Attack The Qilin ransomware-as-a-service (RaaS) operation has listed Branded Products, a Melbourne-based branded merchandise supplier, as its latest victim. The hackers added the company to their leak site on 24 May, though details remain scarce only a link to Branded Products’ ZoomInfo profile was provided. Neither Qilin nor the affiliate behind the attack has disclosed the volume of stolen data, its contents, or any ransom demands. Branded Products is one of seven companies named by Qilin on the same day. The company, which serves high-profile clients including the NSW government, Department of Foreign Affairs and Trade, Melbourne Avalon Airport, and Specsavers has not responded to requests for comment. Headquartered in Cranbourne West, Melbourne, the firm operates across Australia and New Zealand, with procurement teams in China, supplying products like drinkware, IT gear, and sports apparel. Qilin has emerged as a dominant ransomware threat in 2026, claiming 1,862 victims since 2022 and currently leading in attack volume. The group operates under a RaaS model, taking a cut of ransom payments from affiliates. However, its tactics have been inconsistent some victims, like Australian IT firm Bluize (breached this month), saw their data published, while others from earlier in the year remain in limbo with no leaked files but visible leak posts. This suggests varying extortion strategies or technical capabilities among affiliates. With 12 Australian victims in the first half of 2026 alone, Qilin’s targeting of Branded Products underscores the persistent risk to supply chain and corporate entities in the region.

Brisbane Accounting Firm Hit by Qilin Ransomware, Client Data Leaked A Brisbane-based accounting firm, Kennedy McLaughlin & Associates, has confirmed a cyber incident after being listed on the darknet leak site of the Qilin ransomware operation. The breach, detected earlier this month, involved unauthorized access to part of the firm’s IT environment, with stolen data including financial details of several clients recently published online. The company, which provides taxation, estate planning, and business advisory services, detected the intrusion in March but only saw the full dataset released in June. A spokesperson stated that immediate containment measures were taken, systems were restored, and cybersecurity experts were engaged to bolster defenses. The Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC) have been notified, and affected individuals have been informed with guidance on protecting their information. Qilin, a prolific ransomware-as-a-service (RaaS) group, has claimed 1,882 victims across 98 countries since 2022, making it one of the most active ransomware operations. Unlike some groups that publish data quickly, Qilin and its affiliates may delay leaks for months. In 2024 alone, the group has listed 17 Australian victims, including Melbourne-based Branded Products in May. Kennedy McLaughlin, a registered tax agent with 21 staff, serves clients across industries such as property development, medical professions, and legal services. The firm has emphasized its commitment to security following the incident.