Inotiv Hit by Qilin Ransomware Attack Following $35M Animal Welfare Fine The Qilin ransomware gang has claimed responsibility for a cyberattack on Inotiv, a global pharmaceutical research conglomerate, disrupting operations and exfiltrating 176 GB of sensitive data. The breach, detected on August 8, forced Inotiv to take affected systems offline, though the company has not provided a timeline for restoration. Qilin, a ransomware-as-a-service (RaaS) group known for double extortion tactics, alleges it stole 161,967 files, including financial documents, lab reports, research contracts, and employee records some dating back to 2018. The gang has not set a ransom deadline or indicated when it might leak the data if demands are unmet. The attack comes just months after Inotiv was fined $35 million by the U.S. Justice Department for egregious animal welfare violations at its subsidiary, Envigo. In 2022, the Humane Society rescued over 4,000 beagles from Envigo’s Virginia facility, citing conditions that included maggot-infested food, denial of veterinary care, and nursing mothers being starved. The fine remains the largest ever under the Animal Welfare Act. Inotiv, which employs 2,000 people across 22 locations in North America and Europe, reported $490 million in annual revenue in 2024. The company has engaged cybersecurity experts and law enforcement to investigate the breach, which has impacted internal data storage and business applications. Qilin, active since 2021, has targeted 482 victims in the past year, ranking as the second-most active ransomware cartel in recent months. The group typically focuses on healthcare and manufacturing sectors, with past victims including energy firms and auto suppliers. Cybersecurity experts warn that organizations handling regulated or high-value research data must prioritize rapid containment, robust backups, and threat intelligence sharing to mitigate such attacks. Inotiv’s breach underscores the growing risk to contract research organizations (CROs), which manage vast troves of proprietary data critical to pharmaceutical innovation. The incident follows a pattern of ransomware groups exploiting vulnerabilities in sectors with high-stakes intellectual property.