Heritage Golf Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations across many sectors, including leisure and hospitality businesses that hold customer records, staff details and operational files. Listings on criminal leak sites have become a common way for these groups to pressure victims after data theft. In that landscape, a September 2024 claim involving a Myrtle Beach golf club illustrates how even regional recreational operators can appear in such incidents.

Public reporting states that Heritage Golf was listed by the qilin ransomware group on 25 September 2024. The listing asserts that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail about the intrusion has not been disclosed in available records. The claim matters because any confirmed exposure of internal material could affect members, guests, employees and the club’s day-to-day operations.

Inside the incident

According to the available record, Heritage Golf appeared on a qilin-associated leak site on 25 September 2024. The group’s listing characterises the event as a ransomware attack in which internal files were taken. No public figure has been given for the volume of data, the number of individuals involved, or the precise date the intrusion began. Methods of initial access, encryption status of systems, and any ransom demand are not detailed in the reported summary. The organisation is identified as Heritage Golf, also described in the record as Heritage Club, a golf course on the southern Grand Strand in the Myrtle Beach area. Beyond the leak-site claim itself, independent confirmation of the full scope of the incident has not been supplied in the facts provided.

The group behind it: qilin

qilin is a ransomware operation that has been publicly documented as using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if payment is not made. The group typically operates as a ransomware-as-a-service model, recruiting affiliates who conduct intrusions and share proceeds. Public reporting on qilin has noted its use of leak sites to name victims and, in some cases, to post samples of stolen material. It has been linked to attacks on a range of organisations internationally. In this instance, the group claims that Heritage Golf suffered a ransomware attack involving the exfiltration of internal files. That claim originates from the listing and should be treated as an assertion by the actors rather than independently verified fact unless further confirmation emerges.

Who is Heritage Golf?

Heritage Golf, referred to in the record as Heritage Club, is described as one of the premier golf courses in the Myrtle Beach area, located on the southern Grand Strand. Golf clubs of this type typically manage memberships, tee-time bookings, guest services, retail and food operations, and staff employment. They commonly hold contact information, payment details for dues or green fees, and internal operational records. A breach affecting such an organisation can therefore touch both recreational customers and employees, and can disrupt booking systems, membership communications and financial processes. Because the club serves a tourism-oriented region, any compromise may also involve visitors whose data was collected during play or events.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases or specific categories of personal information has been disclosed. Organisations of this kind routinely store membership applications, contact and billing data, employee records, and operational documents. Whether any of those categories were among the files taken remains unconfirmed. Public detail is limited to the general description of “internal files,” so the exact contents of the claimed exfiltration cannot be stated as established fact.

What's at stake

If internal files containing personal or financial information were obtained, affected individuals could face risks such as phishing, identity misuse or unsolicited contact that leverages knowledge of their association with the club. Employees might see payroll or personnel data exposed. For the organisation, consequences can include operational disruption, costs of investigation and remediation, regulatory notification duties where personal data is involved, and reputational harm among members and visitors. Because the number of people affected is unknown and the precise data types remain undisclosed, the scale of these risks cannot yet be quantified from public information. The listing itself may also be used by the actors to increase pressure, regardless of whether full publication of the files ultimately occurs.

Were you affected?

If you are a member, guest, employee or vendor of Heritage Golf, monitor accounts and statements for unusual activity and treat unexpected messages that reference the club with caution. Consider changing passwords used for any related online services and enable multi-factor authentication where available. Official notifications, if any are issued by the organisation or regulators, should be followed for specific guidance. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets, which can help identify whether further protective steps are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.