Qilin Ransomware Is Hunting Australian Accounting Firms — And the Privacy Act Just Raised the Stakes

Qilin is a ransomware-as-a-service (RaaS) operation, currently ranked the most active ransomware group in the world. It leases its ransomware to affiliates who carry out attacks and share the proceeds. Qilin has claimed roughly 1,500 victims since launch — over 500 in 2026 alone — after absorbing affiliates from disrupted operations including LockBit, RansomHub and ALPHV/BlackCat. Attacks use double extortion: data is stolen before encryption, and non-payers have their data published on Qilin’s dark web leak site.

Qilin has listed 17 Australian victims in 2026, according to Cyber Daily. Confirmed accounting-sector cases include a Brisbane accounting firm — which confirmed a cyber incident after being listed, with published data reportedly including client financial details — and a Victorian accounting firm whose internal documents were posted to the dark web. Professional services firms, including accounting, financial services and legal practices, feature consistently among the targets.

Mostly through internet-facing firewalls and VPNs, and stolen credentials. Affiliates have abused Cisco ASA, Fortinet and SonicWall devices, exploited the PAN-OS authentication bypass CVE-2026-0257, and actively exploited the VPN bypass CVE-2026-50751 since at least May 2026. Access is also bought from Initial Access Brokers or gained with phished credentials against RDP and VPN endpoints. Once inside, affiliates harvest credentials, delete reachable backups, exfiltrate data and encrypt — sometimes within 48 hours.

They combine maximum data value with minimum defences. A small firm holds tax file numbers, bank details, payroll and financial statements for hundreds of clients — ideal for double extortion — while typically having no security staff, no 24/7 monitoring, and remote access that was never hardened. Deadline pressure around tax season and lodgements adds leverage for attackers.

In most cases now, yes. Since 1 July 2026, accountants, lawyers, conveyancers, real estate agents and dealers in high-value goods fall under the Privacy Act regardless of turnover. If a breach involving personal information is likely to cause serious harm, the Notifiable Data Breaches scheme requires notifying the OAIC and affected individuals. Separately, businesses with turnover above $3 million that pay a ransom must report the payment within 72 hours. See our guide to the July 2026 privacy changes for the full picture.

Backups are necessary but not sufficient, for two reasons. First, Qilin affiliates deliberately locate and delete every backup they can reach before encrypting — so backups must be immutable or offline to survive. Second, Qilin steals data before encryption: backups restore your systems, but they do not prevent your clients’ records being published on a leak site. Early detection and hardened access matter as much as recovery.

Paying is not itself illegal, but the Australian Government strongly discourages it, payment may breach sanctions law if the recipient is sanctioned, and businesses with turnover above $3 million must report any ransom payment within 72 hours or face civil penalties. Payment also guarantees nothing — stolen data may still be leaked or sold, and paying marks you as a willing payer.

Four things, in order: confirm your firewall and VPN firmware are current (and retire remote access you no longer use); switch on MFA for every VPN, RDP, email and cloud login; verify you have at least one backup an attacker inside your network could not delete, and test-restore it; and check whether your firm came under the Privacy Act on 1 July — if so, make sure someone owns the breach notification process. If you cannot confidently do all four in-house, that is the signal to bring in a managed provider.

Legal practices appear consistently in the professional services sector trend data for Qilin targeting, alongside accounting and financial services. The named, confirmed Australian victims in 2026 reporting are accounting firms, but the target profile — sensitive client data, thin IT defences, reputational pressure to pay — applies equally to legal and conveyancing practices, which also came under the Privacy Act on 1 July 2026.

A managed service provider runs the layered defence no small firm can staff alone: perimeter patches applied within hours of critical advisories, MFA and conditional access enforced tenant-wide, immutable backups with tested restores, EDR on every endpoint watched 24/7, and a rehearsed incident response plan that includes regulator notification. AyeTech delivers this from $149 per user per month — against an average small business cybercrime cost of $56,600 per incident.

A model where attackers steal a copy of your data before encrypting your systems, giving them two pressure points: pay for a decryption key, and pay again to stop the stolen data being published or sold. Qilin runs this as standard — non-payers are listed on its dark web leak site and their data released. It defeats the assumption that good backups alone make you safe: backups restore systems, but they cannot un-steal data.

ASD puts the average self-reported cost of cybercrime for a small business at $56,600 per report — and ransomware runs far higher. With average downtime around 21 days, plus forensics, rebuilds, client notification, legal advice and potential penalties, the true cost for a 30-person firm commonly reaches $300,000 to over $1 million, before counting lost clients and reputation.

The ACSC via ReportCyber at cyber.gov.au or the hotline 1300 CYBER1 (1300 292 371). If personal information was involved and serious harm is likely, notify the OAIC and affected individuals under the Notifiable Data Breaches scheme. If your turnover exceeds $3 million and you pay a ransom, report the payment to the Australian Government within 72 hours. Also notify your cyber insurer immediately and, where client funds are at risk, your bank.

Isolate affected systems — disconnect them from the network and internet — but do not wipe or rebuild anything yet: logs and forensic evidence matter for recovery and regulatory reporting. Do not contact the attackers or pay anything. Call your IT provider or incident response team, verify your backups are intact and disconnected, report to the ACSC on 1300 292 371, and start a written timeline — you will need it for insurers and the OAIC.

Most policies cover ransomware response — forensics, recovery, business interruption, sometimes ransom payments — but coverage depends on the controls you declared. Insurers increasingly require MFA, EDR, tested backups and patching as policy conditions, and claims can be denied if questionnaire answers were inaccurate or controls lapsed. An incident is exactly when you discover whether the controls you attested to were actually in place.

A criminal who specialises in breaking into networks — via VPN vulnerabilities, phished credentials or exposed RDP — and sells that access to ransomware affiliates rather than using it themselves. Many Qilin victims were compromised weeks or months before the ransomware detonated: access was harvested early, sold on, and used later. A quiet network is not evidence of a clean network — detection requires actively looking.

Usually one of four ways: a ransom note tells you; a dark web monitoring service detects your domain, credentials or documents; the ACSC or a security researcher notifies you; or a journalist calls. By the time data appears on a leak site, the theft happened days or weeks earlier — monitoring buys response speed, not prevention. Managed security providers typically include dark web monitoring for client domains and staff credentials.

Safer in one dimension, not safe overall. The cloud platform itself is unlikely to be encrypted, but your firm still runs workstations, email, document management and shared drives full of client records — all encryptable — and an attacker with stolen credentials can log into your cloud platforms and exfiltrate client data without touching an encryptor. Cloud accounting removes one target; it does not remove the need for MFA, endpoint protection and hardened remote access.

Substantially, yes — it was designed around exactly these techniques. Patching closes the firewall and VPN holes Qilin exploits; MFA blocks stolen-credential logins; restricted admin privileges limit lateral movement; application control blocks unauthorised executables; and regular backups enable recovery. No framework guarantees immunity, but a firm at Maturity Level 1 or above is a dramatically harder target than the average small professional services firm.

EDR (Endpoint Detection and Response) watches the behaviour of every computer — credential harvesting, unusual admin activity, mass file changes — rather than just matching known virus signatures like traditional antivirus. Qilin intrusions can go from first access to full encryption in under 48 hours, often outside business hours; EDR paired with 24/7 monitoring is what catches the intrusion during that window instead of after it. It is also now a common cyber insurance requirement.

The Australian average is around 21 days of downtime, but the spread is enormous. Firms with immutable backups, tested restores and an incident response plan can be operating again in days. Firms whose backups were deleted in the attack — a deliberate Qilin step — face weeks of rebuilding, possible permanent data loss, and a ransom decision made under duress. Recovery time is mostly determined by decisions made before the attack.

The exposure is real and growing. Australia introduced a statutory tort for serious invasions of privacy in June 2025, the OAIC can pursue representative complaints, and clients may claim in contract or negligence where a firm failed to take reasonable care of their information. Professional bodies add confidentiality obligations for accountants and lawyers. This is general information, not legal advice — but documented, reasonable security controls are both your best prevention and your best defence.

Law enforcement disrupted LockBit, ALPHV/BlackCat and RansomHub through 2024–25, but their affiliates did not retire — many moved to Qilin, taking tools and experience with them. That migration is a large part of why Qilin became the world’s most active ransomware operation by 2026. Takedowns shuffle the brand names; the threat consolidates rather than disappears.

Map defences to Qilin’s actual attack chain: patch internet-facing firewalls and VPNs within days of vendor advisories (or retire remote access you no longer need); enforce phishing-resistant MFA on every VPN, RDP, email and cloud login; keep immutable, offline-capable backups and test restores; deploy EDR with 24/7 monitoring to catch the intrusion during the dwell time; and maintain an incident response plan that includes OAIC notification obligations. For most firms without in-house security staff, a managed service provider is the practical way to run all five layers.

Qilin runs double extortion: data is exfiltrated before encryption, and victims who refuse to pay are listed on its dark web leak site and their stolen data published — as happened with the Australian accounting firm victims this year, where client financial details were reportedly included in published datasets. This is why backups alone are not a complete defence: they restore your systems, but they do not un-steal your clients’ data. Preventing exfiltration through early detection matters as much as recovery.

No — targeting is largely automated. Qilin affiliates scan the entire internet for vulnerable firewalls and VPNs and buy whatever access brokers are selling; a five-person firm with an unpatched VPN appears in the same scan results as a corporation. A large share of Australian cybercrime reports come from small businesses — and small professional services firms hold valuable client data behind the weakest defences, which is precisely the appeal.