PQCNC Hospitals Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and public-health organisations, where operational disruption and sensitive records create strong leverage for extortion. Against that backdrop, a listing on a ransomware leak site has drawn attention to PQCNC Hospitals, reported on 14 October 2025.

Public reporting states that the Perinatal Quality Collaborative of North Carolina—also referred to in the listing as PQCNC Hospitals—was named by the qilin ransomware group, which claims internal files were exfiltrated. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. For patients, clinicians, and partners who work with the organisation, the claim alone is enough to warrant careful attention to what is known and what is not.

Breaking down the breach

According to the available record, PQCNC Hospitals was listed by the qilin ransomware group on or around 14 October 2025. The group’s claim is that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the precise method of initial access. The count of people whose information may have been exposed is listed as unknown.

Details such as when the intrusion began, how long attackers remained inside the network, whether encryption was deployed alongside theft, or whether any ransom demand was made have not been disclosed in the material provided. The listing itself is an assertion by the threat actor; it has not been independently verified in the facts at hand. Organisations in this position commonly investigate, engage incident responders, and notify regulators or affected parties once the facts are clearer—steps that may still be under way or simply not yet public.

Who is qilin?

Qilin is a ransomware operation that has operated as a ransomware-as-a-service model, recruiting affiliates who carry out intrusions while the core group supplies malware, infrastructure, and a leak site used for pressure. Like many contemporary ransomware crews, it is associated with double-extortion tactics: encrypting systems where possible and threatening to publish stolen data if payment is not made. Public reporting over recent years has linked the name to attacks across multiple sectors, including healthcare and related services, though each incident must be assessed on its own evidence.

In this case, the group’s leak-site listing is the source of the claim that PQCNC Hospitals was compromised and that internal files were taken. No further statements attributed specifically to qilin about this victim—such as sample file counts, screenshots, or deadlines—are included in the facts. Readers should treat the listing as an unverified claim until the organisation or independent investigators confirm or refute it.

PQCNC Hospitals and its sector

The Perinatal Quality Collaborative of North Carolina is a community-focused organisation dedicated to improving maternal and infant health outcomes across the state. It supports initiatives, resources, and quality-improvement work that typically involve hospitals, clinicians, public-health partners, and families. Entities of this kind sit at the intersection of healthcare delivery and public-health coordination; they often handle clinical quality data, programme records, and communications that support safer care for mothers and newborns.

A breach claim against such an organisation is consequential because the sector routinely processes information that is both personal and sensitive. Even when the primary mission is quality improvement rather than direct clinical care, the data and systems involved can still affect patient privacy, trust in public-health programmes, and the continuity of collaborative work among hospitals and agencies. Disruption or exposure can therefore reach beyond a single institution to the wider network of providers and families those programmes serve.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific categories of personal data, medical records, employee files, or financial documents—has been named. The number of individuals potentially affected is unknown.

Organisations focused on perinatal quality and maternal–infant health typically hold or process materials that may include programme participation records, clinical quality metrics, contact details for clinicians and partners, and sometimes limited patient-related information used for improvement projects. Whether any of those categories were among the files claimed by qilin is unconfirmed. Until the organisation publishes a clearer description, the exact contents of the alleged exfiltration remain undisclosed.

Why it matters

For individuals, the practical risk depends on what was actually taken. If personal or health-related information was included, possible consequences include unwanted contact, phishing that exploits knowledge of a person’s connection to maternal or infant care programmes, or longer-term identity-related misuse. Even internal operational files can enable more convincing social-engineering attempts against staff or partner hospitals.

For the organisation, a ransomware claim can interrupt quality-improvement work, strain relationships with clinical partners, and trigger regulatory and notification obligations once the facts are established. Rebuilding confidence after any confirmed incident takes time and transparent communication. Because the scale and contents remain unknown, the prudent approach is to prepare for a range of outcomes rather than assume either a minor or a catastrophic exposure.

Were you affected?

If you have interacted with PQCNC Hospitals or the Perinatal Quality Collaborative of North Carolina—as a patient, family member, clinician, or partner—monitor official notices from the organisation and from relevant state or federal authorities. Watch for unexpected emails or calls that reference maternal or infant health programmes and avoid clicking links or providing credentials in response to unsolicited messages. Consider placing fraud alerts with credit bureaus if you later learn that financial or identity data was involved, and change passwords on any accounts that reused credentials associated with the organisation.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention while more detail about the PQCNC listing becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.