UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026

Qilin ransomware-as-a-service (RaaS) was highly active against UK organisations in H1 2026, listing up to 37 British victims on its Tor leak site and averaging 7–9 UK victims per month; notable impact includes exfiltration of over 32,000 patient records tied to a Synnovis/NHS supplier incident. The report details Qilin’s tactics — exploiting corporate VPN gateways (Fortinet, Check Point, WatchGuard), leveraging BYOVD to bypass EDR/AV, and occasional use of SmarterMail and SolarWinds vectors — highlights SME targeting and cross-posting on multiple leak sites, and provides defensive guidance such as hardening web-facing services, enforcing phishing-resistant MFA, adopting outsourced MDR, and integrating community threat feeds.