Richmond СPA Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-service firms that hold concentrated stores of financial and personal records, turning routine accounting work into a high-value target for data theft and extortion. In this environment, listings on criminal leak sites have become a common way for attackers to pressure victims and advertise their operations.

On 13 April 2025, the ransomware group qilin listed Richmond CPA, a West Virginia accounting firm, claiming it had stolen roughly 300 GB of internal files and would publish them in full on 28 April if a ransom was not paid. The number of people affected remains unknown, and independent confirmation of the claim is not yet public. The listing nonetheless places clients, employees and business partners of the firm in a position of uncertainty about what may have been taken and what may soon appear online.

Inside the incident

Public reporting on 13 April 2025 stated that Richmond CPA had been listed by the qilin ransomware group. According to the group’s own claim, all data belonging to the firm—approximately 300 GB—had been exfiltrated during a ransomware attack and would be published in full on 28 April if the firm refused to pay a ransom. The only data category named is “internal files.” No further technical details about the intrusion method, the precise date of compromise, or any encryption of systems have been disclosed. The number of individuals whose information may be involved is listed as unknown. The group’s statement also includes a short self-description of the victim as a full-service accounting firm licensed in West Virginia that serves business owners and executives; that language appears to be drawn from the firm’s own materials rather than independent verification of the breach itself.

Because the listing originates from the attackers, it remains an unverified claim until corroborated by the firm, regulators or forensic investigators. No official confirmation of data publication or of any ransom payment has been included in the available record.

Inside qilin

Qilin is a ransomware operation that has been active for several years and is known for double-extortion tactics: encrypting systems while simultaneously stealing data and threatening to leak it on a dedicated site if payment is not made. The group typically recruits affiliates who gain initial access, deploy the ransomware payload, and manage negotiations. Public reporting on prior campaigns shows that qilin has targeted a range of mid-sized organisations across professional services, manufacturing and healthcare, often advertising stolen data volumes in the tens or hundreds of gigabytes. Its leak site is used both as a pressure tool and as a public showcase of claimed victims. In this case the group asserts that it holds Richmond CPA’s data and has set a publication deadline of 28 April; those assertions should be treated as claims rather than established facts about the firm’s systems.

Who is Richmond СPA?

Richmond CPA is described in the attackers’ listing as a full-service accounting firm licensed in West Virginia that provides a broad range of services to business owners and executives. Firms of this type routinely prepare tax returns, maintain financial statements, handle payroll, advise on business structure and retain multi-year archives of client records. Those records commonly include Social Security numbers, bank-account details, tax identification numbers, income figures, corporate ownership documents and personal contact information for both individuals and entities. Because the firm sits at the centre of its clients’ financial lives, a breach of its internal systems can expose sensitive material belonging to many separate people and companies at once. The consequential nature of such an incident therefore stems less from the firm’s size than from the concentrated trust placed in it and the long retention periods typical of accounting work.

What was likely exposed

The only data type named in the available record is “internal files” said to have been exfiltrated in a ransomware attack, with a claimed volume of around 300 GB. Exact contents have not been disclosed or independently verified. Organisations of this kind typically hold client tax filings, financial statements, payroll data, correspondence, engagement letters and supporting identity documents. It is therefore reasonable to expect that any large internal archive could contain personal identifiers, financial account numbers and confidential business information. However, no inventory of specific files, fields or individuals has been released, and the precise nature of what was taken remains unconfirmed. Readers should treat any later appearance of documents online as requiring careful verification rather than automatic acceptance of the attackers’ claims.

The real-world impact

For individuals and businesses whose records may have been among the internal files, the primary risks are identity theft, tax-related fraud, unauthorised access to bank or investment accounts, and targeted phishing that leverages accurate personal or financial details. Because accounting firms retain multi-year histories, older data can still be used to open new credit lines or file fraudulent returns. For the firm itself, the incident carries operational disruption, potential regulatory notification duties, reputational harm and the cost of forensic investigation and client communication. Clients may face months of elevated monitoring even if the full 300 GB claim is never substantiated or published. The absence of a confirmed headcount of affected people means that anyone who has used Richmond CPA’s services in recent years has reason to treat the possibility of exposure seriously until clearer information emerges.

What to do if you're exposed

If you are a current or former client or employee of Richmond CPA, begin by placing fraud alerts with the major credit bureaus and reviewing recent tax transcripts and bank statements for unexpected activity. Change passwords on any accounts that may have shared credentials or recovery information with the firm, and enable multi-factor authentication wherever it is available. Monitor for phishing messages that reference tax preparation, invoices or personal details that only an accounting firm would normally know. Keep records of any suspicious contacts. As a practical next step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; doing so provides an early signal while official notifications, if any, are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.