Thorndale Foundation Investigates Data Breach After Qilin Ransomware Listing The Thorndale Foundation, a disability support organization serving the Nepean and Hawkesbury regions of New South Wales, is probing a data breach after being listed by the Qilin ransomware group on September 15. The foundation confirmed the incident to Cyber Daily, stating it had reported the matter to the Australian Cyber Security Centre (ACSC) and other authorities but declined further comment while investigations remain ongoing. Qilin, currently the most active ransomware operation in 2026 with an average of 100 victim listings per month, shared six documents as proof of the breach. These included passport scans, a signed confidentiality agreement, an invoice, and a list of names linked to the foundation. However, the group has not disclosed the size of the compromised dataset or a timeline for potential full publication. Operating under a ransomware-as-a-service (RaaS) model, Qilin provides affiliates access to its infrastructure in exchange for a share of ransom payments. The group has claimed 2,306 victims since its emergence in 2022, with recent activity including a Cisco Secure Firewall Management Center vulnerability and a breach of Sydney-based app developer DigiGround last month. The Thorndale Foundation, based in Werrington, supports over 200 participants through group homes, employment assistance, disability day programs, and NDIS social activities, serving as a key provider in Western Sydney. The breach’s full impact on the organization and its clients remains under assessment.