Qilin Claims Attack on Heber City, Utah
The ransomware group has listed the small Utah municipality on its dark-web site. The city has not confirmed any incident, and the claim could not be independently verified.
Key points
- Qilin, a ransomware-as-a-service operation, listed Heber City, Utah on its dark-web leak site on October 24, 2026.
- Heber City has not publicly confirmed any breach, and the claim could not be independently verified at publication time.
- Qilin has appeared in 12 Threat Vectr stories in the last 90 days, the most recent filed yesterday.
- Manufacturing is the sector Qilin most often targets in Threat Vectr's data, though this listing targets a local government.
Qilin is a ransomware-as-a-service operation: the core developers rent their malicious software, which locks a victim's files and demands payment to restore them, to criminal affiliates who carry out the actual attacks. The group runs a dark-web leak site, a page on a hidden part of the internet, where it names organisations it claims to have attacked. The tactic is pressure: publish the name, threaten to release stolen data, and hope the target pays.
On October 24, 2026, the monitoring service Ransomware.live observed Qilin add Heber City, Utah to that list. Heber City is a municipality in Wasatch County. The group's post contained no specific data description. Listings are written by attackers to intimidate, are sometimes exaggerated, and are sometimes outright false.
Heber City has made no public statement, and no independent evidence of a breach has surfaced.
How active is Qilin right now?
Very. We covered Qilin's claim against Joliet Public Schools District 86 on 15 October 2026, another public-sector target, and the group listed a Colorado restaurant equipment supplier just the day before this claim. Manufacturing is the most commonly targeted sector in our tracking data, but local government bodies have appeared repeatedly in Qilin's listing history.
A group posting at that pace isn't running opportunistic attacks. Affiliates cycle through targets quickly, which means victim response time is short.
Should you worry about your data?
The claim is unconfirmed. That said, criminals sometimes use news of an alleged breach to run follow-on scams, so treat any unexpected call or email mentioning the city or offering breach compensation with real scepticism.
If you hold an account with any Heber City online service, change the password and don't reuse it elsewhere. A password manager makes this simple. Anyone who gets a call claiming to be from a breach-resolution service should hang up and contact the city directly through its official website at heberut.gov before sharing personal details.
City staff should report anything unusual on their computers to their IT department immediately. Ransomware affiliates often sit inside a network for days before locking files, and early reports can limit the damage.
