Qilin Ransomware Tops H1 2026; 31K Firms Exposed in VwbP Breach

For cybersecurity practitioners, the H1 2026 threat landscape unequivocally demonstrates that the most dangerous adversaries are those combining operational disruption with data exfiltration. Qilin’s RaaS-fueled surge across manufacturing, healthcare, construction, and professional services signals that no sector is immune to crippling encryption and extortion. At the same time, the breach of a government beneficial ownership registry affecting 31,000 firms, and the leak of police and government contact details, exposes the cascading risks when trusted platforms and law enforcement databases are compromised. These events are a call to action for security teams to harden defenses against both ransomware operators and the systemic supply chain vulnerabilities they exploit.

The first half of 2026 has further cemented ransomware as a dominant threat vector while exposing systemic weaknesses in government and law enforcement data protection. The Cyber Express weekly roundup reveals that the Qilin ransomware group emerged as the most active operation during this period, leveraging the ransomware-as-a-service model to strike manufacturing, healthcare, construction, and professional services organizations worldwide. This sustained campaign coincided with two impactful data breach incidents: a compromise of the Register of Beneficial Owners (VwbP) affecting approximately 31,000 legal entities, and a leak from the Police National Legal Database (PNLD) that exposed sensitive contact details of police officers and government officials.

“

Qilin’s RaaS-fueled surge across manufacturing, healthcare, construction, and professional services signals that no sector is immune to crippling encryption and extortion.

The Qilin group's dominance underscores the maturation of the ransomware economy. RaaS platforms enable technically unsophisticated affiliates to launch sophisticated attacks, leading to a proliferation of incidents across diverse sectors. The targeted industries—manufacturing and healthcare—are particularly vulnerable due to operational technology dependencies and high-stakes patient safety concerns. The construction and professional services sectors are increasingly targeted as gateways to larger supply chains. Qilin’s dual focus on encryption and data exfiltration raises the stakes: organizations face not only operational disruption but also the threat of public data leaks, regulatory fines, and reputational damage.

The VwbP breach is a stark reminder that government registries, often considered low-value targets, hold rich troves of personally identifiable and corporate ownership data. The exposure of beneficial owner information for 31,000 firms can facilitate fraud, money laundering, and targeted phishing against company executives. Authorities responded by taking the registry offline and forming a crisis team, with initial findings indicating no data tampering. However, the incident highlights the need for zero-trust architectures and rigorous access controls even in public-sector databases.

The PNLD data breach, which leaked names, organizations, and work email addresses from police and government personnel, introduces an additional layer of risk: these contacts are prime targets for spear-phishing, credential harvesting, and social engineering attacks aimed at penetrating law enforcement networks. The overlap between compromised identities and ongoing investigations could compromise operational security. Both breaches reinforce the growing risk of third-party and platform-based intrusions, where attackers target service providers to pivot into their clients’ environments.