Counts & Dobyns Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 13, 2026, the name Counts & Dobyns appeared on a leak site operated by the Qilin ransomware group. The listing states that internal files were taken during a ransomware operation. No figure for the number of individuals affected has been released, and the organization has not issued a public statement confirming or denying the claims.

The appearance of a professional-services firm on such a site illustrates a continuing pattern in which ransomware operators target organizations that hold records of lasting value to clients or counterparties. When internal data is asserted to have been removed, the consequences extend beyond the immediate victim to any parties whose information was stored in those systems.

Inside the incident

Public reporting is limited to the July 13, 2026 listing on the Qilin leak site. The group claims to have exfiltrated internal files, but no additional details—such as the volume of data, the date of the intrusion, or the encryption status of systems—have been disclosed. The number of people whose information may be involved remains unknown.

Inside qilin

Qilin is a ransomware-as-a-service operation that has been active since at least 2022. Like several other contemporary groups, it employs a double-extortion model: data is encrypted on victim systems and a copy is removed for later publication if the ransom demand is not met. The group maintains a leak site where it lists organizations it claims to have compromised, a tactic intended to increase pressure on victims. Qilin has previously listed entities across multiple industries, though the accuracy of any individual listing is determined only after independent verification.

Counts & Dobyns and its sector

Counts & Dobyns operates in the professional-services sector, where firms routinely maintain confidential client records, correspondence, and supporting documentation. Such organizations are attractive to threat actors because the material they hold can retain relevance for regulatory, legal, or competitive purposes long after an incident occurs. A breach at one firm can therefore affect not only its own operations but also the clients or matters referenced in the compromised files.

The information in question

The only description provided is “internal files exfiltrated in ransomware attack.” No inventory of specific data categories—such as client names, financial details, or communications—has been released. Organizations of this type commonly store personally identifiable information, privileged legal or financial records, and internal administrative documents; however, the precise contents of the material claimed by Qilin have not been confirmed.

Why it matters

Exposure of internal files from a professional-services firm can create downstream risks for clients whose matters are referenced in those records. Potential harms include misuse of confidential information, follow-on fraud attempts, or reputational effects that persist even if the original files are never publicly released. For the organization itself, the incident may trigger regulatory scrutiny, contractual obligations to notify affected parties, and costs associated with investigation and remediation.

Were you affected?

Individuals who have been clients of Counts & Dobyns or who have corresponded with the firm should monitor their accounts and correspondence for unusual activity. Practical steps include reviewing bank and credit statements, enabling multi-factor authentication where available, and remaining alert to unsolicited requests for personal information. Readers may also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.