Radiant Beauty Supplies Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure mid-sized commercial suppliers across North America, often by claiming data theft and threatening public release. On 14 October 2025 the ransomware operation known as qilin listed Radiant Beauty Supplies on its leak site, asserting that internal files had been taken in an attack. The number of people affected remains unknown, and public detail on the intrusion itself is limited. For a long-established Canadian supplier serving salons and beauty professionals, any confirmed exposure of internal material carries practical consequences for customers, staff and trading partners.

This article sets out only what has been reported, places the claim in context, and outlines the steps people can take if they believe their information may have been involved.

Inside the incident

According to the available record, Radiant Beauty Supplies was listed by the qilin group on 14 October 2025. The group claims that internal files were exfiltrated during a ransomware attack. No public confirmation of the intrusion method, the date the systems were first compromised, the volume of data taken, or the precise systems affected has been released. The number of individuals whose information may have been involved is recorded as unknown. Beyond the group’s leak-site listing and the statement that internal files were removed, further technical or operational detail remains undisclosed.

The group behind it: qilin

qilin is a ransomware operation that has been active for several years and is widely documented as operating a ransomware-as-a-service model. Affiliates typically gain access to networks, encrypt systems, and exfiltrate data before demanding payment. The group commonly employs double-extortion tactics: encryption is paired with the threat of publishing stolen material on a dedicated leak site if the ransom is not paid. Public reporting has associated qilin with attacks on organisations in multiple sectors and countries. In this case the group claims to have listed Radiant Beauty Supplies and to have removed internal files; those assertions have not been independently verified in the material provided and should be treated as claims rather than What's Publicly Reported.

Radiant Beauty Supplies and its sector

Radiant Beauty Supplies is described as a Canadian-owned and operated business that has served the professional beauty industry since 1968. It focuses on distributing sought-after global brands and carries products for hair, aesthetics and related professional use. Companies of this type typically maintain supplier and customer records, order histories, inventory systems, employee information and financial documentation necessary for wholesale distribution to salons and beauty professionals. A breach affecting such an organisation is consequential because the data held often includes contact details, purchasing patterns and, in some cases, payment or identity information belonging to small businesses and individual practitioners who rely on the supplier. Even limited exposure of internal files can disrupt operations, erode commercial trust and create secondary risks for those whose details appear in the material.

What was likely exposed

The only data type named in the available facts is “internal files” said to have been exfiltrated in a ransomware attack. Exact contents, file counts and categories have not been disclosed. Organisations operating as professional beauty-product distributors commonly hold customer account records, purchase orders, shipping addresses, employee personnel files, supplier contracts and financial or inventory data. Whether any of those categories were among the files claimed by qilin is unconfirmed. Readers should therefore treat specific personal or commercial data types as possible rather than established.

The real-world impact

If internal files were indeed taken, affected individuals and businesses face concrete risks that do not require sensational framing. Contact details and order histories can be used for targeted phishing or social-engineering attempts. Employee records, if present, may contain identifiers that facilitate identity fraud or credential stuffing. For the company itself, the listing can interrupt supply chains, force temporary system isolation, and generate notification and remediation costs. Customers who are independent salons or aesthetic practitioners may experience delayed deliveries or need to re-establish accounts. Because the scale of any exposure remains unknown, the practical impact ranges from limited inconvenience for some parties to more serious fraud risk for others; the precise distribution of that risk cannot yet be determined from public information.

What to do if you're exposed

Anyone who has done business with Radiant Beauty Supplies or believes their details may appear in its internal records should take a small number of measured steps. Monitor bank and credit-card statements for unfamiliar activity and consider placing a fraud alert or credit freeze with the major Canadian credit bureaux if identity documents or financial data could be involved. Change passwords on any accounts that reused credentials linked to the company, and enable multi-factor authentication wherever it is offered. Be alert to unsolicited emails or calls that reference beauty-industry purchases or claim to come from the supplier. Finally, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; doing so provides an additional, low-effort indicator of prior exposure without requiring payment or personal data beyond the email itself.

AICompiled with AI assistance from public sources and published under our editorial standards.