Otthon Centrum Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 27, 2026, the qilin ransomware group listed Otthon Centrum on its leak site, stating that internal files had been taken from the organisation. No further details on the volume of data, the method of intrusion, or confirmation of any ransom demand have been made public. The number of people whose information may be involved is not known. The incident adds to the pattern of ransomware operators targeting organisations that maintain records on individuals and property transactions.

Breaking down the breach

The only confirmed public information is the listing itself on May 27, 2026. The group claims to have exfiltrated internal files during a ransomware operation. No timeline for the initial access, no count of affected records, and no description of the encryption or exfiltration methods have been disclosed by either the organisation or the group.

Public reporting has not yet included statements from Otthon Centrum confirming or denying the claims, nor has any independent verification of the data’s authenticity been published.

Inside qilin

Qilin is a ransomware operation that has conducted multiple campaigns since at least 2022. The group typically uses double-extortion tactics, encrypting systems and threatening to publish stolen material if a ransom is not paid. Its leak sites follow a standard format in which claimed victims are listed with brief descriptions of the data allegedly taken.

Like other ransomware groups, qilin has targeted entities across multiple sectors. Its activity is tracked by security researchers through the consistent infrastructure and naming conventions used on its sites. The listing of Otthon Centrum follows this established pattern but remains an unverified claim until corroborated by the organisation or independent evidence.

About Otthon Centrum

Otthon Centrum operates in the real-estate sector, handling property listings, client transactions, and related administrative records. Organisations of this type routinely collect and store personal identifiers, contact details, financial information connected to purchases or rentals, and documents tied to property ownership or financing.

A breach at such an entity is consequential because the records often contain data that can be used for identity verification or financial fraud, and because real-estate transactions frequently involve multiple parties whose information is retained for extended periods.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types, databases, or categories of personal data has been released. Organisations in this sector commonly retain client names, addresses, identification numbers, bank details, and contract documents, yet the exact contents of the material claimed by qilin remain unconfirmed.

What's at stake

Individuals whose records appear in the exfiltrated files could face risks of identity misuse or targeted fraud, depending on the sensitivity of the documents. The organisation itself may encounter regulatory scrutiny, operational disruption, and costs associated with investigation and remediation.

Because the scale and precise nature of the data are not yet known, the full extent of these risks cannot be quantified from currently available information.

Were you affected?

Check any official notices issued by Otthon Centrum for guidance specific to this incident. Individuals can also take the following steps while further details emerge:

• Monitor bank and credit accounts for unauthorised activity.
• Review and update passwords for any accounts linked to property or financial services.
• Enable multi-factor authentication on email and financial platforms.
• Run a free exposure scan of your email address against known breach data to see whether your information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.