Qilin Claims White & Case in Latest Leak-Site Listing
The ransomware group has listed the global law firm on its dark-web site. White & Case has not confirmed any incident, and the claim has not been independently verified.
Key points
- Qilin, a ransomware group, listed White & Case on its dark-web leak site on 25 October 2026, claiming to have attacked the US-based law firm.
- White & Case has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
- Ransomware listing posts are written by criminals to pressure victims into paying and are sometimes exaggerated or false.
- Qilin has featured in 14 Threat Vectr stories in the past 90 days, more than any other single group we've tracked across law-firm coverage in that window.
Qilin, a criminal ransomware group that encrypts victims' files and threatens to publish stolen data unless a ransom is paid, listed White & Case on its dark-web site on 25 October 2026. Ransomware.live, a monitoring service that tracks these claims, observed the listing. White & Case is a global law firm headquartered in the United States.
The group's post contained no specific data description. That's notable: attackers typically include file counts or data categories to increase pressure on a victim. Whether the omission reflects early-stage negotiation, a bluff, or simply an incomplete listing is impossible to say from outside.
White & Case has not publicly confirmed any incident. No statement appeared on the firm's website as of publication, and the claim could not be independently verified.
How busy is Qilin right now?
Busy enough to warrant attention. We covered Qilin's claim against US law firm Iliff, Meredith, Wildberger & Brennan on 14 October 2026, and law firms have featured in six of our stories in the past 90 days across multiple groups. Qilin alone accounts for 17 Threat Vectr stories since we first covered the group on 24 June 2026.
Volume doesn't make any individual claim more credible. Groups sometimes inflate their lists with old data or fabricated entries to appear more powerful. Each listing has to stand on its own merits.
What should White & Case clients and staff do now?
Practical steps matter even before a breach is confirmed.
If you're a client of the firm, watch your inbox. Criminals who list a company publicly sometimes use the publicity to send fake emails impersonating the firm, a tactic called phishing, where fraudulent messages trick people into handing over passwords or clicking harmful links. Any message claiming to be from White & Case about a data breach should be treated with suspicion until you verify it through a phone number you already hold.
Don't reuse any password you may have shared with the firm across other accounts. One breached site puts every other account sharing that password at risk.
Be sceptical of unsolicited calls offering "breach compensation" or asking you to confirm personal details. These scams often follow high-profile leak-site listings and have nothing to do with the named company.
For staff, check that multi-factor authentication, which adds a one-time code or hardware key on top of a password so a stolen credential alone can't open an account, is enabled across all internal systems. A password without that second factor is an open door.
