Japan's police agency counts 53 companies struck by the Qilin ransomware group, one of the most significant tallies of corporate victims attributed to a single ransomware operation in the country to date.

The figure comes from the national police agency, which has been tracking attacks by the Qilin crew against Japanese organizations. The disclosure puts a concrete number on what until now had been an amorphous threat for Japanese enterprises.

Who is behind the attacks?

Qilin is a ransomware-as-a-service operation. Affiliates rent the payload and infrastructure, execute intrusions, and split extortion proceeds with the developers. That model lets the group scale quickly across targets and geographies.

The 53 confirmed victims span Japanese companies. The police agency's count represents confirmed cases, so the real exposure across the Japanese enterprise base could run higher as investigations continue.

What does this mean for CISOs?

A single ransomware brand racking up 53 corporate victims inside Japan signals sustained, repeatable access rather than opportunistic hits. For security leaders, the takeaway is straightforward:

• Treat ransomware crews as durable, well-resourced operations, not one-off criminal actors.
• Assume affiliate-driven groups can hit multiple companies in the same market within a short window.
• Track law-enforcement victim counts as a leading indicator of attacker focus on your region.

Why the number matters

Law-enforcement attribution at this scale is rare. When a national police agency names a specific group and a specific victim count, enterprises gain a verified baseline for threat modeling — something marketing-driven threat reports cannot match.

Japanese organizations that have not yet reviewed their ransomware readiness should treat the disclosure as a prompt. The attackers behind Qilin have demonstrated both the intent and the operational capacity to hit dozens of companies in a single national market.

Security teams should verify backup isolation, test restoration times, and confirm that incident-response contracts are in place before, not after, an intrusion lands in their environment.