# Qilin ransomware claims Tanner victim

Published: 2026-09-04 · Severity: high
Canonical: https://vorant.io/reports/11c4a038-07cd-5364-8dde-ef84645fba05/qilin-ransomware-claims-tanner-victim

> Qilin ransomware gang publicly lists Tanner as a victim with 51 compromised employees and 2022 user accounts exposed.

Ransomware.live, a tracking platform that indexes publicly disclosed victims by ransomware operators, reports that the Qilin ransomware group has posted Tanner as a victim on their leak site. The posting indicates 51 compromised employee accounts, 2022 compromised user accounts, and 118 DNS records associated with the victim's domain, suggesting a significant breach. Third-party employee credentials totaling 51 accounts were also reportedly accessed during the intrusion. This represents a standard ransomware-as-a-service (RaaS) victim disclosure, where the operator publicly lists a victim to pressure payment or extort data. No technical exploitation details, specific dates, or attack methodology are provided in this report—it is a victim index entry rather than analysis of the attack itself.

## Mentioned in this report

- Threat actors: qilin
- Malware: Qilin

Source reporting: https://www.ransomware.live/id/VGFubmVyQHFpbGlu

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/11c4a038-07cd-5364-8dde-ef84645fba05/qilin-ransomware-claims-tanner-victim.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup