Ransomware: qilin claims PenLink (US) — Government & Defense

On August 14, 2026, the ransomware group Qilin publicly claimed responsibility for a cyberattack against PenLink, a US-based technology provider serving the government and defense sectors. The claim was published on the group’s leak site, as tracked by ransomware.live, and is now flagged under the BREACH framework. This indicates that the attackers have likely exfiltrated sensitive data and are using the threat of public disclosure to pressure the victim into paying a ransom.

The primary affected organization is PenLink, but the impact extends to its clients, which include federal, state, and local law enforcement agencies, as well as defense and intelligence contractors. Because PenLink supplies investigative and analytical software, any compromise of its systems could expose case data, operational methods, and personally identifiable information related to ongoing investigations. This creates significant downstream risk for any public-sector entity that relies on PenLink’s products.

Compliance teams should immediately verify whether their organization uses PenLink software or services and assess exposure to this incident. If affected, activate your incident response plan, preserve logs, and notify your designated data protection authority if personal data is involved. Review contractual obligations with PenLink regarding breach notification and data handling. Additionally, monitor Qilin’s leak site for any published data and prepare for potential regulatory inquiries under frameworks like GDPR or sector-specific rules. Finally, reinforce third-party risk management by requesting a formal impact statement from PenLink and updating your vendor risk register.