INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Qilin Publishes New Victim City of Columbia SC

| 2026-10-29 15:09 CRITICAL HIGH RANSOMWARE & EXTORTION
Executive Summary
AI-generated
On October 29, 2026, the City of Columbia in South Carolina was targeted by Qilin, a ransomware gang, with an estimated attack date also on that day. The attackers are believed to be from the United States, and their malware payload is identified as Qilin. No third-party employee credentials were compromised, but 159 users were affected. The attack works by exploiting DNS records for the victim's domain, which was discovered by HudsonRock. As of now, no further information on the current status of the incident has been provided.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables 3 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

sha256 1 md5 2
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
QilinQilin
Target & Sectors
NORTH_AMERICA NORTH_AMERICA energyenergy manufacturingmanufacturing retailretail healthhealth transportationtransportation financefinance
Incident Timeline
‎2026/10/29 15:09
Threat actors, identified as Qilin, compromised DNS records and credentials of employees at the City of Columbia, SC on October 29, 2026.
source_region United States
malware Qilin
organisation UTC
organisation HudsonRock Compromised Employees
tactic T1589.001 - Credentials
organisation DNS Records
organisation DNS
victims 0 Compromised Users
data_breach 159 Party Employee Credentials
general_metric 2 External Attack Surface
general_metric 26 DNS
‎2026/10/29
Threat actors, identified as Qilin, compromised DNS records and credentials of the City of Columbia, SC on October 29, 2026.
source_region United States
malware Qilin
organisation UTC
organisation HudsonRock Compromised Employees
tactic T1589.001 - Credentials
organisation DNS Records
organisation DNS
victims 0 Compromised Users
data_breach 159 Party Employee Credentials
general_metric 2 External Attack Surface
general_metric 26 DNS
‎2026/10/29
Ransomware operators, identified as Qilin, have published the City of Columbia, SC, as a new victim on their platform.
organisation SC
infrastructure Microsoft 365
organisation Stripe Zoho Campaigns Leak Screenshot
infrastructure 365 Stripe Zoho
Tactical Metrics
Metrics
victims
0
Compromised Users
Metrics
data_breach
159
Party Employee Credentials
Metrics
infrastructure
‎Microsoft 365
Affected Product
Metrics
infrastructure
365
Stripe Zoho
Intelligence Sources