# Eat Salad breached by Qilin ransomware operators

Published: 2026-06-03 · Severity: high · Sectors: retail
Canonical: https://vorant.io/reports/d1531232-2b80-5d5d-81aa-66ab6573d4e9/eat-salad-breached-by-qilin-ransomware-operators

> Qilin ransomware gang claims breach of Eat Salad with 123 compromised users and exposed attack surface.

Ransomware.live reports that Qilin ransomware operators have claimed responsibility for a breach of Eat Salad, a food service company. The breach exposed 123 user accounts and one set of third-party employee credentials. The attackers identified 20 points on the victim's external attack surface, including DNS records, indicating reconnaissance of the target's network perimeter. The posting includes a leak screenshot as proof of compromise. This follows the typical Qilin playbook of data exfiltration followed by extortion demands. The breach demonstrates the continued targeting of commercial food service businesses by ransomware operators seeking both financial gain and data monetization.

## Mentioned in this report

- Threat actors: qilin
- Malware: Qilin

Source reporting: https://www.ransomware.live/id/RWF0IFNhbGFkQHFpbGlu

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d1531232-2b80-5d5d-81aa-66ab6573d4e9/eat-salad-breached-by-qilin-ransomware-operators.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup