EQ Chartered Accountants Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms that hold concentrated volumes of client financial and personal records, using double-extortion tactics that combine encryption with the threat of public data dumps. In this environment, listings on criminal leak sites have become a routine pressure mechanism, even when independent confirmation of an intrusion remains limited.

On 26 November 2024, the ransomware group known as qilin publicly listed EQ Chartered Accountants on its leak site, claiming to have stolen more than 800 GB of data—described by the group as mostly client data—and giving the firm 48 hours to make contact or face full publication. The number of people affected has not been disclosed, and public detail beyond the group’s own statements remains limited. The incident matters because accounting practices routinely process sensitive financial and personal information belonging to individuals and businesses, so any confirmed or claimed exfiltration raises immediate questions about exposure and secondary misuse.

Inside the incident

According to the listing attributed to qilin, the group claims to have exfiltrated internal files from EQ Chartered Accountants in a ransomware attack. The group’s own statement asserts that more than 800 GB of data was taken, “mostly CLIENTS data,” and that the company had 48 hours to contact the attackers or the material would be posted. No independent confirmation of the intrusion method, the exact date of access, the encryption status of systems, or any ransom demand amount has been made public. The number of individuals or client entities affected is listed as unknown. The only concrete claim available is the group’s assertion of volume and content type, together with the deadline threat. Whether the data has since been released, or whether any negotiation occurred, is not part of the public record provided.

Inside qilin

Qilin is a well-documented ransomware-as-a-service operation that has been active for several years. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it on a dedicated leak site if payment is not made. Affiliates often gain initial access through phishing, compromised credentials, or exploitation of remote-access services, then move laterally to identify high-value file shares before deploying the ransomware payload. Qilin has previously listed victims across professional services, manufacturing, and other sectors, using the same public-shaming approach of timed countdowns and claims of large data volumes. The group’s statements about any specific victim, including EQ Chartered Accountants, remain unverified claims unless corroborated by the organisation or independent investigators. Public reporting on qilin has consistently noted that its operators focus on organisations holding commercially or personally sensitive records, precisely because the threat of exposure increases pressure to pay.

Who is EQ Chartered Accountants?

EQ Chartered Accountants is a professional accountancy practice. Firms of this type provide audit, tax, bookkeeping, advisory, and compliance services to individuals, small businesses, and larger entities. In the ordinary course of work they collect and store client financial statements, tax returns, bank details, payroll information, identity documents, and correspondence that often includes personal addresses, dates of birth, and National Insurance or tax reference numbers. Because these records are both commercially valuable and regulated under data-protection law, a breach—claimed or confirmed—carries consequences that extend beyond the firm itself to every client whose information may have been held. The sector as a whole has become a recurring target for ransomware operators precisely because the data is concentrated, sensitive, and difficult for clients to change quickly.

What data was at risk

The only description supplied by the listing is that internal files were allegedly exfiltrated and that the volume exceeded 800 GB, characterised by the group as mostly client data. No further breakdown of file types, specific databases, or categories of personal information has been disclosed. Organisations of this kind typically hold tax filings, financial statements, bank and payment details, payroll records, identity documents, and related correspondence. Whether any of those categories were in fact among the claimed 800 GB remains unconfirmed. Public detail is limited to the group’s assertion; independent verification of the precise contents has not been published.

What's at stake

For clients, the practical risks include identity theft, fraudulent tax filings, unauthorised access to bank accounts, and targeted phishing that uses accurate personal or financial details to appear legitimate. Even if the data is never published, the mere fact of exfiltration means it may already be circulating among criminal buyers. For the firm, the consequences include regulatory scrutiny under data-protection regimes, potential civil claims from affected clients, reputational damage that can erode trust, and the operational cost of investigation, notification, and remediation. Because the number of people affected is unknown, the scale of any required notification or support programme cannot yet be assessed. The 48-hour deadline claimed by the group also illustrates the compressed timeline under which organisations must decide whether to engage, restore systems, or prepare for public disclosure—decisions that affect both the firm and every individual whose records may be involved.

If your data was in this claimed breach

If you are a current or former client of EQ Chartered Accountants, treat the listing as a credible warning even while details remain unconfirmed. Monitor bank and tax accounts for unexpected activity, enable multi-factor authentication wherever available, and be alert to phishing messages that reference genuine accountancy or tax matters. Consider placing fraud alerts with credit-reference agencies if you believe identity documents or financial identifiers may have been exposed. You can also run a free exposure scan of your email address to check whether that address or associated credentials have already appeared in known breach data sets. Keep records of any unusual contact and report confirmed fraud to the relevant authorities and your financial institutions promptly.

AICompiled with AI assistance from public sources and published under our editorial standards.