Reported by 15 outlets

Timeline

1. original reporting

   Qilin ransomware group core member extradited from Japan to Germany; detained in Osaka, international RaaS investigation

   rocket-boys.co.jp · 8d ago · October 5th, 2026

   Qilin ransomware group core member — alleged Russian national — extradited from Japan to Germany; detained in Osaka, international investigation into RaaS https://rocket-boys.co.jp/security-measures-lab/qilin-core-member-japan-germany-extradition-2026/

   via Mastodon https://rocket-boys.co.jp/security-measures-lab/qilin-core-member-japan-germany-extradition-2026/

2. update from digital.asahi.com

   Qilin ransomware core member detained in Osaka: expert says attack activity intense — Asahi Shimbun

   digital.asahi.com · 8d ago · October 6th, 2026

   Ransomware group Qilin core member detained in Osaka: expert says attack activity is intense — Asahi Shimbun https://digital.asahi.com/articles/ASVB541QYVB5UTIL01CM.html?ptoken=01M4766F1Y3QETKVYF6V446GJT

   via Mastodon https://digital.asahi.com/articles/ASVB541QYVB5UTIL01CM.html?ptoken=01M4766F1Y3QETKVYF6V446GJT

3. update from japancyberwatch.com

   Japan detained a core Qilin ransomware member and extradited him to Germany, the Asahi Shimbun reports (unnamed sources, no official stateme

   japancyberwatch.com · 8d ago · October 6th, 2026

   Japan detained a core Qilin ransomware member and extradited him to Germany, the Asahi Shimbun reports (unnamed sources, no official stateme

   via Mastodon https://japancyberwatch.com/articles/qilin-ransomware-member-detained-japan-extradited-germany-2026

4. update from japancyberwatch.com

   Monitor law enforcement announcements regarding Qilin operations and indictments for further personnel changes at the organization. Reward:

   japancyberwatch.com · 8d ago · October 6th, 2026

   Monitor law enforcement announcements regarding Qilin operations and indictments for further personnel changes at the organization.

5. update from malware.news

   Japan hands over ‘Qilin’ hacker group member to Germany

   malware.news · 7d ago · October 6th, 2026

   JiJi reports: Japanese police have captured a Russian national believed to be a key member of the “Qilin” international hacker group and extradited him to Germany, investigative sources said Tuesday. Qilin is believed to have carried out ransomware attacks against companies worldwide, causing major damage through data encryption. In 2025, the group claimed responsibility online… Source Article Link: https://databreaches.net/2026/10/06/japan-hands-over-qilin-hacker-group-member-to-germany/

6. update from japantimes.co.jp

   Japan Hands Over 'Qilin' Ransomware Group Member to Germany

   japantimes.co.jp · 7d ago · October 6th, 2026

   submitted by /u/Baller2908 [link] [comments]

   via reddit r/cybersecurity: Japan Hands Over 'Qilin' Ransomware Group Member to Germany

7. update from www.heise.de

   Japan extradites suspected Qilin ransomware developer to Germany

   www.heise.de · 7d ago · October 6th, 2026

   Japan has extradited a ransomware suspect to Germany in a rare move. Translated from German. Original: https://www.heise.de/en/news/Rare-occurrence-Japan-extradites-ransomware-suspect-to-Germany-11478532.html

8. mentioned by www.japantimes.co.jp

   Japanese police have captured a Russian national believed to be a key member of the "Qilin" international hacker group and extradited him to

   www.japantimes.co.jp · 7d ago · October 6th, 2026

9. update from securityweek.com

   Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany

   securityweek.com · 6d ago · October 7th, 2026

   The suspect, a 28-year-old Russian national, was detained in Osaka in May and was reportedly handed over to the German authorities on October 2. Believed to be a core member of the ransomware gang, the individual was wanted in Germany for hacking into a logistics company in September 2024, encrypting data on its systems, and extorting it of over $160,000 in cryptocurrency. Also known as Agenda , Qilin has been active since August 2022 and has become one of the most prolific ransomware-as-a-service (RaaS) operations, hitting hundreds of organizations worldwide and causing millions of dollars in damages. In 2024, the group was blamed for hacking into pathology lab services provider Synnovis and causing disruptions at multiple London hospitals run by the National Health Service. The incident caused operational disruptions and resulted in the personal information of roughly 2 million people being compromised. Throughout 2025, the group listed 400 victims on its Tor-based leak site, including Lee Enterprises and pharma company Inotiv . In June this year, Qilin was exploiting a critical authentication bypass vulnerability in Check Point VPN and firewall products, tracked as CVE-2026-50751. In August, the US Bureau of Alcohol, Tobacco, Firearms and Explosive

10. update from cyberworldops.eu

    German authorities took custody on Oct 2 of a 28-year-old Russian national detained in Osaka, suspected of involvement in Qilin ransomware.

    cyberworldops.eu · 6d ago · October 7th, 2026

    German authorities took custody on Oct 2 of a 28-year-old Russian national detained in Osaka, suspected of involvement in Qilin ransomware. via Mastodon https://cyberworldops.eu/en/qilin-case-crosses-borders-as-germany-takes-custody-of-russian-suspect

11. update from fawkes.rocks

    Qilin ransomware suspect arrested in Japan, sent to Germany https:// fawkes.rocks/2026/10/07/qilin- ransomware-suspect-arrested-in-japan-sen

    fawkes.rocks · 6d ago · October 7th, 2026

    Qilin ransomware suspect arrested in Japan, sent to Germany https:// fawkes.rocks/2026/10/07/qilin- ransomware-suspect-arrested-in-japan-sen

    via Mastodon https://fawkes.rocks/2026/10/07/qilin-ransomware-suspect-arrested-in-japan-sent-to-germany/

12. update from www.japantimes.co.jp

    A Russian national believed to be a key member of the notorious Qilin international hacker group was arrested by German authorities after be

    www.japantimes.co.jp · 5d ago · October 8th, 2026

    A Russian national believed to be a key member of the notorious Qilin international hacker group was arrested by German authorities after be

    via Mastodon https://www.japantimes.co.jp/news/2026/10/08/japan/crime-legal/germany-arrest-qilin-japan-extradite/?utm_medium=Social&utm_source=mastodon

13. update from bleepingcomputer.com

    Germany arrests alleged core Qilin ransomware member after extradition

    bleepingcomputer.com · 4d ago · October 9th, 2026

    Japan has confirmed the extradition to Germany, with the National Police Agency saying that the suspect was detained after arriving in the country as a tourist. “When a Russian national for whom Germany had obtained an arrest warrant in connection with a ransomware incident in Germany arrived in Japan, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant, and then facilitated the extradition,” [machine translated] reads the press release . Earlier this week, Japanese media reported the arrest based on internal sources, but authorities in the country have now officially confirmed the action. Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda, and deployed typical double-extortion attacks, where data is stolen before being encrypted. By more recent statistics, the group targeted more than 2,350 known organizations across 62 countries. Among the victims are Japanese automaker Nissan , Japanese brewery Asahi , U.S. newspaper publisher Lee Enterprises , and Australia’s Court Services Victoria . The attack on Asahi, Japan’s largest beer p

14. update from securityaffairs.com

    Germany arrests suspected Qilin ransomware leader after Japan detention

    securityaffairs.com · 4d ago · October 9th, 2026

    Germany arrests suspected Qilin ransomware leader after Japan detention, per SecurityAffairs: https://securityaffairs.com/200695/uncategorized/germany-arrests-suspected-qilin-ransomware-leader-after-japan-detention.html

    (Translated from Italian.)

    via Mastodon https://securityaffairs.com/200695/uncategorized/germany-arrests-suspected-qilin-ransomware-leader-after-japan-detention.html

15. mentioned by cybernews.com

    Suspected Qilin hacker caught in Japan and extradited to Germany

    cybernews.com · 3d ago · October 10th, 2026

16. mentioned by www.bleepingcomputer.com

    Japan handed a 28-year-old Russian to Germany on 2 October, an alleged core member of the Qilin ransomware crew. He had been detained in Osa

    www.bleepingcomputer.com · 3d ago · October 10th, 2026

17. mentioned by tugatech.com.pt

    Germany detains alleged Qilin ransomware leader after extradition from Japan. German authorities detained a Russian citizen suspected of being a core member.

    tugatech.com.pt · 1d ago · October 12th, 2026

18. mentioned by www.bleepingcomputer.com

    # Germany arrests alleged core # Qilin # ransomware member after extradition https://www. bleepingcomputer.com/news/secu rity/germany-arrest

    www.bleepingcomputer.com · 1d ago · October 12th, 2026

19. mentioned by therecord.media

    ⚠️🥷 Japan extradites suspected Qilin operative to Germany A 28-year-old Russian was arrested in Osaka in May over a German # ransomware atta

    therecord.media · 1d ago · October 12th, 2026

20. update from insicurezzadigitale.com

    From vacation in Osaka to Frankfurt cell: German infiltration at top of Qilin ransomware gang

    insicurezzadigitale.com · 18h ago · October 13th, 2026

    From vacation in Osaka to a Frankfurt cell: German infiltration at the top of Qilin. The arrest is linked to German infiltration at the group's leadership levels. via Mastodon https://insicurezzadigitale.com/dalle-vacanze-a-osaka-alla-cella-di-francoforte-linfiltrazione-tedesca-ai-vertici-di-qilin/

21. mentioned by insicurezzadigitale.com

    From vacation in Osaka to a Frankfurt cell: German infiltration at the top of Qilin

    insicurezzadigitale.com · 18h ago · October 13th, 2026