A disability support organisation serving the Nepean and Hawkesbury regions is investigating a data breach after being listed by the Qilin ransomware group.
“We are aware of the allegations referred to in your correspondence,” the Thorndale Foundation told Cyber Daily after Qilin’s claims were put to it.
“The matter has been reported to the Australian Cyber Security Centre (ACSC) and relevant authorities and remains under investigation.
“As this process is ongoing, we are unable to provide any further comment at this time.”
One of Qilin’s affiliates posted details of the hack in a 15 September leak post. The hackers have not shared any details regarding the size of the compromised dataset, nor when the full set will be published.
Qilin has, however, shared six documents as evidence of the hack, including a pair of passport scans, a signed confidentiality agreement, an invoice, and a list of names linked to the Thorndale Foundation.
Who is Qilin?
As of the time of writing, Qilin is the most active ransomware operation in existence, averaging about 100 victim listings each month in 2026 so far. Since it was first observed in 2022, the group has notched up 2,306 victims.
The group operates under a ransomware-as-a-service model, with affiliates gaining access to its ransomware infrastructure in return for a cut of any ransom payments.
Networking giant Cisco recently warned of Qilin activity targeting a vulnerability in its Secure Firewall Management Center software
The group’s Sydney-based app developer, DigiGround, was listed by the hackers last month.
Who is the Thorndale Foundation?
Based in Werrington, NSW, the Thorndale Foundation offers disability support services to the lower Blue Mountains, Nepean, and Hawkesbury regions.
The foundation operates six group homes with four to five residents each, as well as employment support, disability day programs, and NDIS social group activities.
“Thorndale has over 200 participants, and is recognised in Western Sydney as a disability organisation of choice,” the organisation said on its website.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
