Key takeaways

  • In Japan, Qilin is the ransomware group most people can name. It claimed the 2025 attack that stopped Asahi Group's orders and shipments for about two months, Japan's police counted it as the most common ransomware in 2025, a man believed to be one of its leaders was detained in Japan this year, and it has now listed the railway group Keio.
  • On the leak sites, 2026 looks different. According to the tracking site ransomware.live, The Gentlemen has listed 23 Japanese organizations so far this year, more than any other group. Qilin has listed 15. The Gentlemen had listed none before January.
  • The Gentlemen is not entirely new. Group-IB says it grew out of one of Qilin's most active affiliate teams, which broke away in a dispute over unpaid commission in 2025.
  • Japanese organizations on its list that have confirmed an attack include Medica Publishing, whose breach may have exposed about 772,000 records, the textile maker Omikenshi and Saga University.
  • In our view, Japan's current wave of data breach disclosures should not crowd out ransomware on the management agenda. A breach costs money and trust; ransomware can stop the business for weeks.
  • Its usual way in is the same one Japan's police keep reporting: VPN devices and firewalls, especially FortiGate, with stolen or weak credentials. In our view, that matters far more than which brand ends up on the ransom note.

Why Japan knows the name Qilin#

Few ransomware groups become household names. In Japan, Qilin did.

  • Asahi Group, September 2025. The brewer's order and shipment systems were down for about two months, one of the most disruptive attacks Japan has seen. Qilin claimed it, and Japan's information security agency IPA names it in connection with the attack in its 2026 white paper.
  • Police statistics. In the National Police Agency's figures for 2025, Qilin's share of cases "increased sharply". Of the cases where the ransomware could be identified, it accounted for the most, ahead of LockBit, as we set out in our guide to Japan's ransomware statistics.
  • An arrest in Japan. In October 2026, Japan and Germany confirmed that a man believed to be one of Qilin's leaders had been detained in Japan and handed over to Germany.
  • Keio. The same month, Qilin listed the Tokyo rail and retail group Keio, and Keio has confirmed it is aware of the claim.

So when a Japanese company is hit by ransomware, "Qilin" is often the first name in the coverage. On the leak sites, though, it is no longer the busiest group targeting Japan.

What the leak sites show#

ransomware.live collects the victims that ransomware groups post on their leak sites. Its Japan listings, as of October 19, 2026:

Group 2026 (to Oct 19) 2025
The Gentlemen 23 0
Qilin 15 28
Everest 10 0
SafePay 7 4
AiLock 5 0
NightSpire 5 3
All groups 120 114

The 2025 runners-up after Qilin were Clop (8), Lynx (6), and Warlock, RansomHouse and Devman (5 each).

Three things stand out.

  • 2026 has already passed 2025. With ten weeks to go, Japanese listings are above last year's total.
  • The field is wider. Qilin alone accounted for about a quarter of Japanese listings in 2025. In 2026, 40 different groups have listed Japanese organizations, and the top group has under a fifth.
  • The Gentlemen rose steadily, not in a burst. Its first Japanese listing was in January, and it has added one to five every month since. About a third of those listings are manufacturers.

An independent count agrees. The Korean threat intelligence firm S2W, in a report summarized by Mynavi on October 14, counted 64 Japanese leak-site cases in the first half of 2026, about 1.6 times the 2025 half-year average, and said The Gentlemen posted the most of any group, rising from one case through 2025 to 13. Japanese security firm MBSD, which monitors The Gentlemen's leak site, found organizations from more than 60 countries and regions on it, with Japan fifth in Asia.

Who are The Gentlemen?#
First reported Trend Micro, September 2025, describing a campaign it investigated in August 2025 by a "previously undocumented" group
Origins Group-IB says the core team was ArmCorp, "a very active" Qilin affiliate. In July 2025 its leader, known as hastalamuerte, publicly accused Qilin's operators on a criminal forum of withholding a $48,000 commission, and the team went independent
Model Ransomware as a service: about 20 core members, according to Group-IB, plus affiliates who carry out the intrusions
Growth Kaspersky says activity "ramped up" at the start of 2026
Targets Manufacturing first, then construction, healthcare and insurance, with a focus on Asia-Pacific (Trend Micro). Leaked internal chats show members choosing targets by industry, revenue and country using commercial business databases (MBSD)

How it gets in. The reports agree. Affiliates come in through internet-facing VPN devices and firewalls, using vulnerabilities and stolen or weak credentials. Trend Micro found a compromised FortiGate administrator account in the attack it investigated. Group-IB says the group's leader handed affiliates a ready-made list of compromised Fortinet devices, about 14,700 at one point, to pick from. MBSD found members sharing lists of FortiGate IP addresses that included Japan as a candidate country.

What it does next. It uses legitimate administration tools and Group Policy to push ransomware across a Windows domain at once, and vulnerable signed drivers to switch off security software. Its internal chats, leaked in May 2026 and analyzed by MBSD, show members struggling with EDR, and sometimes reporting success in stopping it, and deliberately going after backups. Kaspersky says it often deploys ransomware within hours of getting in, though in some cases the access had been set up long before, possibly bought from initial access brokers.

None of this is new. In MBSD's words, the group combines known routes, exposed VPN devices, leaked credentials, Active Directory and backup systems, rather than relying on unknown vulnerabilities.

Japanese victims#

A leak site listing is the attacker's claim. Most Japanese organizations on these lists have not confirmed it, and we do not name them here. These are the ones that have confirmed a ransomware attack or similar incident themselves and appear on a group's list, from our ransomware tracker:

Group Organization What the organization disclosed
The Gentlemen Medica Publishing (medical and nursing publisher), March Some data confirmed leaked; about 772,000 personal records may have leaked, affecting universities and other users of its services
The Gentlemen Omikenshi (textiles), March Core systems stopped and files encrypted, delaying its financial closing
The Gentlemen Saga University, September Files on a network storage device used by administrative staff encrypted
Qilin Anabuki group (real estate), February Entry through a group company's network device; 207,773 people's data may have leaked
Qilin Musashino University, June Restored from backups, but files with names and addresses later found leaked
Qilin Ikegami Tsushinki (broadcast equipment), September Files encrypted; data believed to be its own later published
Qilin Keio, September Business systems at group companies disrupted; trains unaffected
Everest Hosokawa Micron (powder processing equipment), February; Unirita (IT software), September Hosokawa Micron: files appeared online, including personal data with My Number. Unirita: data stolen from a document management system
Eclipse The Japan Times, October An old administrative file server hit; HR and partner data from 2001–2022 published

What the numbers do not show#

  • Listings are not attacks. Victims who pay, or who are never posted, do not appear. Groups also post victims twice, or exaggerate. Leak site counts show what attackers chose to publish, not how many attacks took place, so we do not compare them with official statistics.
  • Brands are not people. The intrusions are carried out by affiliates, who can work for several groups at once and move between them. Group-IB makes the point directly: whichever group claims an attack, an individual or affiliate team actually carried it out.
  • Earlier years are hard to compare. Leak site tracking has improved over time, so we compare only 2025 and 2026 here.

Our analysis#

Breaches fill the headlines; ransomware stops the business#

Since September, Japanese coverage has been dominated by data breaches: member databases and APIs at skyticket, SourceNext, Burger King, Yamato and dozens of others. They deserve the attention. But in our view, for a company's management, ransomware should stay at least as high on the list.

The two risks are different in kind. A data breach costs money for investigation, notices and support, and damages trust, but the business usually keeps running, and as we have argued before, much of the harm falls on customers. Ransomware stops operations. In 2025, it halted Asahi Group's orders and shipments for about two months. This year, it has cancelled a week of classes at Osaka Metropolitan University, took down servers for 495 companies and local governments at IDCF Cloud, stopped card payments at some Keio group stores, and delayed Omikenshi's financial closing.

The cost of that is visible in Japan's police survey of victims: only just under half recovered within a month, and six in ten spent ¥10 million or more, as we set out in our guide to the statistics. Separately, on the leak sites, Japanese listings in 2026 have already passed last year's total.

The breach wave and ransomware often share the same weak points, internet-facing systems and stolen credentials, so the work overlaps. What ransomware adds is the question of continuity: backups an attacker cannot reach, a tested restore, and a decision made in advance about what to shut down and how to keep operating while systems are down.

The famous name is not the threat model#

Japanese coverage reaches for Qilin because Asahi made it famous. In our view, that is understandable for news, but it is a poor basis for deciding what to defend against. A security team that tunes its threat intelligence to the group in the headlines will be looking at last year's leader, while a group most Japanese readers have never heard of posts a Japanese organization almost every two weeks.

Same affiliates, new brand#

The Gentlemen's origins make the point. The people behind it learned their trade as a Qilin affiliate, left over money, and set up their own brand with their own affiliates. Japan's police have said the same thing in their own data: when international operations hit a ransomware group, attacks by that group fall "significantly", and new groups move in. Arresting a Qilin leader in Japan was a real achievement. It does not reduce the number of people who know how to break into a Japanese company through its VPN.

The way in is the constant#

What does not change from brand to brand is the entry point. The Gentlemen hands its affiliates compromised FortiGate devices. Japan's police find that about half of the ransomware victims who could identify the entry point were breached through VPN devices. In our view, the practical questions for a Japanese security team are the same whichever group is on the ransom note:

  • Is every internet-facing VPN device and firewall patched, and are any of them old, unused or forgotten?
  • Do remote access accounts require multi-factor authentication, and are default or shared administrator accounts gone?
  • Is the management interface of each VPN device and firewall closed to the internet? In the attack Trend Micro investigated, the FortiGate was directly reachable and its administrator account was used by the attackers
  • Are the logs of the VPN device itself sent somewhere and actually reviewed, so that repeated failed VPN logins or a new administrator account would be noticed?
  • Are backups kept where a domain administrator cannot delete or encrypt them?
  • If EDR is switched off by a vulnerable driver, are logs already stored somewhere else?

What this means for readers#

  • If you track threats to Japanese organizations, add The Gentlemen to the groups you watch, alongside Qilin. Trend Micro, Group-IB, Kaspersky and MBSD have all published indicators and techniques.
  • If you run FortiGate or other VPN devices, assume they are on someone's list. Check administrator accounts and logs, not only the firmware version.
  • If you read a Japanese breach notice that mentions a leak site claim, remember it is a claim. The organization's own findings are what matter, and many never name the group at all.
  • If you brief management on cyber risk, keep ransomware on the agenda alongside data breaches, and ask how long the business could run without its core systems, not only how customer data is protected.
  • If your organization has subsidiaries or suppliers in Japan, many of the confirmed victims above were reached through group companies or IT contractors. Their VPNs are part of your attack surface.

Japanese terms at a glance#

Japanese Reading Meaning
ランサムウェア ransamuwea Ransomware
リークサイト rīku saito Leak site run by a ransomware group
犯行声明 hankō seimei Claim of responsibility
アフィリエイト afirieito Affiliate (an attacker working under a ransomware brand)
初期アクセスブローカー shoki akusesu burōkā Initial access broker
VPN機器 VPN kiki VPN device