Ransomware Group: QILIN

VICTIM NAME: Xperthair

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

On August 16, 2025, a leak page attributed to the victim Xperthair was published. The post presents itself as a data-leak notification rather than an encryption incident and suggests that personal customer information—such as names, home addresses, and birth dates—may have been exposed. For safety, any such PII referenced in the text is redacted in this summary. The page includes a claim URL, but there are no visible screenshots, images, or downloadable files in the available data. There is no ransom amount or payment demand stated in the excerpt.

The metadata associates the victim with the Philippines, while the post body briefly mentions another cosmetics company in Ireland; this summary focuses on the named victim, Xperthair. The event is described as a data-leak rather than encrypted devices, and no compromise date is provided beyond the post date (which serves as the reference point). The page shows no media assets (images_count is 0) and there are no attached downloads, though a claim URL is present. The threat group tag in the metadata is “qilin.” No specific ransom figure is disclosed within the available content.