Ransomware: qilin claims Goodwill Manasota (US) — Consumer Services

A new ransomware incident has been publicly claimed by the Qilin group, targeting Goodwill Manasota, a US-based consumer services organization. The claim was published on the ransomware.live leak site on July 3, 2026, under the BREACH framework. This indicates that the threat actor has exfiltrated data and is likely to release it unless a ransom is paid. While this specific event is US-focused, it serves as a regulatory signal for EU compliance teams monitoring cross-border data flows and third-party risk.

Organizations in the consumer services, retail, and non-profit sectors are most directly affected, particularly those handling personal data of EU residents. Any entity with supply chain or service dependencies on US-based partners should assess potential data spillover risks. The incident underscores that ransomware groups continue to target organizations with sensitive consumer data, and any breach involving EU personal data may trigger notification obligations under GDPR.

Compliance teams should immediately review their incident response plans to ensure they can detect and report ransomware incidents within 72 hours. Verify that data backup and isolation procedures are tested and operational. Update third-party risk assessments to include ransomware-specific clauses, and confirm that breach notification protocols cover scenarios where data is exfiltrated and published. Finally, brief senior management on the increased likelihood of ransomware attacks targeting consumer-facing organizations.