EURORDIS Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target non-profits, advocacy bodies and health-adjacent organisations across Europe, treating the sensitive data they hold as leverage. In this climate of double-extortion attacks, even organisations focused on rare-disease support have appeared on criminal leak sites. On 14 October 2025, the ransomware group qilin publicly listed EURORDIS, claiming to have exfiltrated internal files. The number of people affected remains unknown, and public detail is limited, yet the listing alone raises clear concerns for anyone connected to the rare-disease community.

What is known is straightforward: EURORDIS was named on a qilin-associated site as the victim of a ransomware attack involving the theft of internal files. No further technical indicators, ransom demands or confirmation of data publication have been disclosed in the available record. The incident matters because EURORDIS works with patient organisations and individuals living with rare conditions—people whose personal and medical information is often highly sensitive.

Breaking down the breach

According to the reported facts, EURORDIS was listed by the qilin ransomware group on 14 October 2025. The group claims that internal files were exfiltrated during a ransomware attack. No figure for the number of people affected has been released; that number is simply unknown. The method of initial access, the duration of the intrusion, any encryption of systems, and whether a ransom was demanded or paid are all undisclosed. Public reporting does not confirm that the stolen files have been published or sold. The only concrete assertion available is the group’s own listing of the organisation and its statement that internal files were taken.

The group behind it: qilin

Qilin is a well-documented ransomware operation that has been active for several years. Like many modern groups, it typically operates on a ransomware-as-a-service model, providing affiliates with tools in exchange for a share of any proceeds. Its established pattern involves double extortion: encrypting systems while also stealing data and threatening to leak it if payment is not made. The group has previously claimed attacks against organisations in multiple sectors, including healthcare and professional services, and maintains a leak site where it posts victim names and, sometimes, sample data. In this case the listing of EURORDIS is a claim made by the group; it has not been independently verified in the public record, and no specific statements by qilin about the contents of EURORDIS files beyond the general assertion of internal-file exfiltration are available.

EURORDIS and its sector

EURORDIS is a European non-profit organisation dedicated to advocating for, empowering and engaging people affected by rare diseases. It works with patient organisations across the continent, provides information and support, and helps connect individuals and families who often face isolation and complex medical pathways. Organisations of this type routinely handle correspondence, membership or contact lists, project documents, and sometimes health-related or personal details shared by patients and carers. Because rare-disease communities are relatively small and tightly knit, a breach can affect people who already navigate significant medical and administrative burdens. The appearance of such an organisation on a ransomware leak site is therefore consequential both for the individuals it serves and for the trust that underpins patient advocacy work.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. Exact data types, file names, volumes and whether any personal or medical records were among them remain unconfirmed. Organisations such as EURORDIS typically hold a range of material that could include:

• Internal administrative and project documents
• Contact or membership information for patient organisations and individuals
• Correspondence and support-related records
• Operational files related to advocacy and information services

None of these categories has been verified as present in the stolen material. Public detail is limited to the group’s claim of internal-file exfiltration; readers should treat any more specific description as unconfirmed.

Why it matters

For people living with rare diseases, the possible exposure of contact details or health-related correspondence can create practical risks: unwanted contact, social-engineering attempts that exploit knowledge of a medical condition, or simply the distress of knowing personal information may be in criminal hands. For EURORDIS itself, the incident can disrupt operations, damage relationships with partner organisations, and require resources to investigate and respond. Even when the precise contents of stolen files are unknown, the mere listing by a ransomware group signals that sensitive organisational data may have left the organisation’s control. In the rare-disease sector, where trust and confidentiality are essential, that uncertainty carries weight for both the people served and the organisation that serves them.

If your data was in this claimed breach

If you have had contact with EURORDIS or related rare-disease networks, treat the possibility of exposure seriously even though the exact contents remain unconfirmed. Practical first steps include monitoring email accounts and financial statements for unusual activity, being cautious of unsolicited messages that reference rare-disease support or personal details, and enabling multi-factor authentication on important accounts where it is not already in place. Consider changing passwords for any accounts that may have been linked to communications with the organisation. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Stay alert to official updates from EURORDIS should further verified information become available.

AICompiled with AI assistance from public sources and published under our editorial standards.