CoreHQ Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
CoreHQ was listed by the qilin ransomware group on 22 December 2025, indicating that internal files were exfiltrated in a ransomware attack. Individuals connected to CoreHQ should check whether their information was exposed and take appropriate protective steps.
What happened
CoreHQ was added to the qilin ransomware leak site on December 22, 2025. The group claims to have exfiltrated internal files in the course of a ransomware attack. No information has been released on the date of the intrusion itself, the volume of data taken, or whether any files were later published.
Inside qilin
Qilin is a ransomware operation that maintains a public leak site to list organizations it claims to have targeted. The group typically combines file encryption with data theft, then uses the threat of disclosure to seek payment. Such listings are presented by the operators as evidence of access but remain unverified claims until independently confirmed by the affected organization or law-enforcement agencies.
About CoreHQ
Public detail on CoreHQ is limited. The organization was listed by the ransomware group without accompanying description of its sector or size. Organizations that hold internal operational records routinely store employee data, client information, and business correspondence; any exposure of such material can create follow-on risks even when the precise contents remain undisclosed.
What data was at risk
The only data category named in connection with the listing is internal files exfiltrated during the ransomware attack. No inventory of file types, record counts, or specific categories such as personal identifiers or financial records has been released. The exact contents therefore stay unconfirmed.
The real-world impact
Individuals connected to CoreHQ face the possibility that personal or professional details held in internal files could surface later. For the organization, the listing adds pressure to manage potential regulatory reporting obligations and to review access controls, even though the scale of exposure is not yet known.
If your data was in this claimed breach
People who have professional or contractual ties to CoreHQ should treat the listing as a prompt to review their own accounts. Practical steps include:
- Monitor bank, email, and government-service accounts for unusual activity.
- Change passwords on any services linked to the organization and enable multi-factor authentication where available.
- Request a copy of any personal data the organization holds about you under applicable privacy laws.
Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Quasar Listed by qilin Ransomware GroupWillowdale Steeplechase Listed by qilin Ransomware GroupARO Listed by qilin Ransomware GroupScenic Solutions Listed by qilin Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the CoreHQ Listed by qilin Ransomware Group →
Publicly posted by qilin — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.