Club Atlético River Plate Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Club Atlético River Plate was listed by the qilin ransomware group on 19 December 2025 after internal files were exfiltrated in a ransomware attack. Because the exact date of the intrusion is not established, anyone connected with the club should check whether their data may have been exposed and take the recommended protective steps.
People connected to Club Atlético River Plate may have personal or administrative records exposed after the club appeared on a ransomware group’s leak site. The practical concern is straightforward: any internal files that contain names, contact details, financial information or membership records could now circulate beyond the organisation’s control, even though the exact contents and number of people affected remain unknown.
The listing was reported on 19 December 2025. At this stage the only confirmed public fact is that the club’s name was posted by the Qilin ransomware group, which claims to have taken internal data.
What happened
Club Atlético River Plate was listed on the Qilin ransomware group’s leak site on 19 December 2025. The group states that it exfiltrated internal files during a ransomware attack. No further details about the timing of the intrusion, the method of access, the volume of data, or whether any ransom demand was issued have been made public. The number of people whose information may be involved is also undisclosed.
Who is qilin?
Qilin is a ransomware-as-a-service operation that has been publicly tracked since 2022. The group typically gains access to corporate or institutional networks, deploys encryption on systems, and copies selected files. It then lists victim names on a dedicated leak site and threatens to publish the stolen material if its demands are not met. Several other organisations in Latin America and Europe have appeared on the same site in recent years, though each case must be assessed on its own evidence.
Who is Club Atlético River Plate?
Club Atlético River Plate is one of Argentina’s largest professional football clubs, with an extensive membership base, commercial partners and administrative operations. Organisations of this type routinely hold records relating to season-ticket holders, merchandise customers, employees and suppliers. A breach at such an institution therefore touches both sporting operations and the personal or financial data of thousands of individuals who interact with the club in ordinary ways.
What data was at risk
The only information released so far states that “internal files” were taken. The precise categories of data have not been published. Clubs of this scale commonly store membership details, payment records, contact information and internal correspondence; however, it is not confirmed whether any of these specific types of records were among the files removed in this incident.
The real-world impact
Until the contents of the exfiltrated files are verified, the main risk to individuals is uncertainty. If personal identifiers or financial references are present, those details could be used for targeted fraud or sold on underground forums. For the club, the incident adds operational and reputational pressure while it investigates the scope of the intrusion and any regulatory obligations that follow.
If your data was in this claimed breach
Monitor bank and email accounts for unusual activity and consider changing passwords for any services linked to the club. Enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
TopDest Listed by qilin Ransomware GroupPublicidad Sarmiento Listed by qilin Ransomware GroupBest Hotels Spain Listed by qilin Ransomware GroupFerreteria Scopazzo Listed by qilin Ransomware GroupLatest breaches
Publicly posted by qilin — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.