Breaches

Qilin lists White & Case on leak site: claim unverified

Qilin has named law firm White & Case on its leak site with no proof. How UK firms and clients should handle an unverified supplier claim.

Warning graphic stating that Qilin's ransomware claim naming law firm White & Case is unverified

The Qilin ransomware gang has added international law firm White & Case to its leak site, but has published nothing to back the claim up. For UK firms and the clients of big City practices, what matters now is how they respond to an unverified listing, not the listing itself.

What happened

On Sunday 25 October 2026, automated trackers that scrape ransomware leak sites picked up a new entry on Qilin’s Tor blog naming White & Case, a major international law firm with a substantial London office. Ransomware.live logged the listing at 17:18 UTC that day, and CyPro reported that RedPacket Security flagged it publicly through a scrape of the gang’s leak page.

At this stage that is all there is. On Ransomware.live, the entry’s description field reads simply “N/A”. It carries no proof-of-claim files, no data samples, no stated volume of data, no ransom demand and no deadline. CyPro’s bulletin notes that RedPacket Security published a verification warning next to its scraped entry, cautioning that Qilin listings have previously included unverified or fabricated victims. CyPro also notes that at least one earlier Qilin claim was refuted.

As of the morning of 26 October, we had found no public comment from White & Case on the listing, and no confirmation from law enforcement, a regulator or mainstream security media. The Ransomware.live page had not been updated since the evening of 25 October. So the accurate position is that a criminal group has made an allegation about the firm. Nobody has established that White & Case suffered an intrusion, lost data or had any systems encrypted.

The detail

Ransomware leak sites are run by the gangs themselves. They are mainly a pressure tool. They exist to shame victims into paying and to advertise the gang’s reach to affiliates. A name on one is a claim, not evidence. Entries can be genuine victims listed before proof is released, recycled older incidents, supplier compromises, or simply wrong. Without proof files or an admission from the named organisation, outsiders cannot tell which of these it is.

Qilin, also tracked as Agenda, is a capable and established ransomware-as-a-service operation, so its claims are not dismissed out of hand. In the UK it is best known for the June 2024 attack on pathology provider Synnovis, which disrupted London NHS hospitals. The fallout from that attack is still landing: in June 2026, Bedfordshire Hospitals NHS Foundation Trust disclosed that more than 32,000 patient records linked to Synnovis tests had been taken. Threat intelligence researcher BushidoToken counted up to 37 UK organisations on Qilin’s leak site in the first half of 2026, more than any other gang. By its count, the gang averaged seven to nine published UK victims a month, mostly small and mid-sized firms.

That track record shows the gang can carry out real attacks. It does not validate this particular entry. The White & Case listing names no access route, affected system or indicator of compromise.

Checklist of six steps UK organisations should take when a supplier is named on a ransomware leak site without evidence

Why it matters for UK organisations

Law firms are high-value third parties. They hold deal documents, litigation strategy, privileged correspondence and large volumes of personal data about clients and counterparties. If a major firm is genuinely compromised, the impact spreads well beyond its own staff, to every corporate client whose M&A, disputes or regulatory work sits in its document systems.

The sector is also an established target. Kroll’s breach report, published on 22 October, found that professional services accounted for 20 per cent of the breaches it observed, level with finance at the top of the table. Earlier this month, The Record reported that leaked chats from the Silent Ransom Group showed members discussing how to get recruited “agents” physically into US law firm offices. One negotiation in those chats involved a firm where someone had copied files onto a flash drive.

The UK regulatory picture adds to the pressure. Where a law firm processes personal data for you as your processor, UK GDPR gives you, as controller, 72 hours to notify the ICO once you become aware of a reportable breach. That raises a practical question for in-house legal and security teams this week. Does a criminal’s unverified claim about your supplier start that clock? In my view it does not on its own. But it should start a documented assessment, so that you can show the ICO you acted promptly if the claim turns out to be true.

Expert view

In my experience, leak-site listings cause two opposite failures. Some organisations panic: they cut off supplier access, send out client notices and brief the board as if a breach were confirmed, then find the claim was recycled or false. Others ignore it completely because “it’s just a ransomware blog”, and lose days if the claim turns out to be real. Neither response is good risk management.

The better approach is to treat the listing as an intelligence signal with a confidence rating. Make a formal enquiry through your existing relationship contacts, ask whether the firm is investigating, and check what your own systems share with it. When we test client environments, the links to professional advisers are often poorly mapped. Shared data rooms, guest accounts in collaboration tenants, standing mailbox rules and old file-transfer accounts tend to sit outside routine access reviews. That is the attack surface that matters if a supplier is ever genuinely compromised.

Silence from a named firm in the first 24 to 48 hours is normal and proves nothing either way.

What to do now

  1. Verify through trusted channels. If you work with the named firm, ask your relationship partner or supplier management contact for a status update. Do not act on the leak-site entry alone, and record what you asked and when.
  2. Do not visit or download from leak sites. Alleged samples can be malicious, and handling stolen data creates legal problems of its own. Use reputable trackers and official statements instead.
  3. Map your exposure to every legal adviser. List shared data rooms, guest and external accounts, API connections and file-transfer services, and confirm what sensitive material each one holds.
  4. Tighten access now, whatever happens with the claim. Remove stale external accounts and enforce phishing-resistant MFA on shared portals. This maps directly to the Cyber Essentials controls for user access control and secure configuration.
  5. Review logs for unusual activity on accounts and integrations linked to outside counsel. Preserve the records if anything looks wrong.
  6. Pre-agree your UK GDPR decision path. Decide in advance who assesses supplier breach claims and what evidence starts the 72-hour ICO clock, and put breach notification terms into your contracts with law firms.

Bottom line

As things stand, Qilin has named White & Case and offered no evidence. The firm has not confirmed an incident, and nobody should report or treat this as a confirmed breach. What UK organisations should take from it is to have a calm, documented process for unverified supplier claims, and to know exactly what their law firms hold before a real incident forces the question.

Sources

Related Posts