Qilin lists Joliet District 86, two years after LockBit

The Qilin ransomware group listed Joliet Public Schools District 86 on its leak site on 14 October 2026. The district runs 22 schools for about 10,300 pre-kindergarten to eighth-grade pupils in Joliet, Illinois, and it has been here before: LockBit claimed the same district in July 2024. Qilin’s entry gives no data volume, sample or deadline, the district has not commented, and the listing lands in the most active year any ransomware operator has had on the Ransomtracker, with 1,071 Qilin victims recorded since January.

Who is Qilin?

The most prolific leak-site poster of 2026

Qilin is a ransomware-as-a-service operation, originally known as Agenda, that has run since 2022 and now leads every volume table we keep. The Qilin profile on the Ransomtracker shows 1,071 listings so far in 2026 after 1,029 in all of 2025, with 27 new listings in the past seven days alone. Its best-known attack remains the June 2024 intrusion at pathology provider Synnovis, which cancelled thousands of appointments and operations across London hospitals. Schools are a steady part of its intake rather than an exception: in the same week Qilin also posted Friendship Christian School, and two other operators listed public school districts with their names masked, which is how routinely education appears on the live leak-site index.

What is known about the Joliet listing?

Very little, which is itself informative. The entry recorded on 14 October names the district and nothing else: no description of the data, no file count, no countdown and no ransom figure. In our reading of the tracker, Qilin usually posts a description and sample screenshots when it wants to pressure a target, so a bare entry often means negotiations are still open or the affiliate has not yet uploaded material. We found no public statement from the district as of 15 October. Under Illinois’s Personal Information Protection Act the district must notify affected residents, and the Attorney General when more than 500 Illinois residents are affected, once it determines that personal information was compromised.

What happened in 2024?

LockBit listed Joliet Public Schools District 86 on 19 July 2024, five months after Operation Cronos had disrupted the group and while it was rebuilding its affiliate base. The size of that leak was never established publicly, and it is not clear from public records whether the district notified families. A second listing by a different operator two years later fits a pattern we see across the tracker: districts that were hit once tend to be hit again, because the underlying weaknesses, flat networks, shared credentials and ageing remote-access systems, are expensive to fix and the data, which includes children’s records, is easy to sell.

What does the stealer-log exposure show?

Qilin’s affiliates most often enter through valid credentials and exposed remote access, and the district’s domain is well represented in criminal circulation. Stealercheck, which queries the Alerts.bar index that Ransomnews licenses, shows 2,015 exposed credentials associated with joliet86.org in total. Most of those come from older breach compilations, but 44 are staff-account records captured directly by infostealer malware on infected devices, alongside 24 user-account records and 12 session cookies. Those are aggregate counts, not evidence of how Qilin got in. They do describe a district whose staff logins have been circulating for some time, which is the exposure we laid out in stealer logs explained.

What should the district and families do?

The district should say what it knows, even if the answer is that an investigation is under way, because the leak-site entry is already public and parents will hear about it from the local press before they hear it from the school. Families should expect that student and staff records may be in the set and watch for identity misuse in children’s names, which can go unnoticed for years. Staff should reset passwords reused on personal accounts and switch on multi-factor authentication wherever the district offers it. For the IT team, the priorities are the ones that stop a Qilin affiliate from coming back: remove any remote-access service that does not require MFA, rotate every service account, and check backups against a restore test rather than a dashboard.

What this means for school districts

Schools are the most consistently targeted public institutions on the tracker because they combine valuable data with thin defences and a reluctance to disclose. A district listed twice in two years by two different operators is not unlucky; it is a signal that the first incident was treated as an outage rather than a warning. We will update this article when the district responds. The listing remains on the daily digest and in the 2026 year archive.

Frequently asked questions

Sources and further reading

• Ransomnews Ransomtracker, Qilin operator profile, listing recorded 14 October 2026
• Ransomware.live, Joliet Public Schools District 86 victim record
• Breachsense, Joliet Public Schools District 86 data breach, 2024 (LockBit listing of 19 July 2024)
• Illinois General Assembly, Personal Information Protection Act, 815 ILCS 530/10: notice of breach, notice to Attorney General
• Related: LockBit, two years after Operation Cronos, and the threat-group catalogue

Reporting by the Ransomnews Research Team. Exposure figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses; no credentials are reproduced and no leak-site content is linked.