CoreHQ Listed by qilin Ransomware Group

On December 22, 2025, CoreHQ appeared on the leak site operated by the qilin ransomware group. The attackers claim they stole internal files from the company and have published samples as proof. Anyone whose personal information was stored in CoreHQ’s systems could now be exposed.

Confirmed Facts from Public Reporting

Public reporting indicates that CoreHQ was listed on the qilin ransomware leak site on December 22, 2025. The group states it exfiltrated internal data during a ransomware incident. The exact number of people affected remains unknown, and the specific types of records taken have not been fully detailed in available reporting. The leak site continues to display samples of the stolen material.

Why This Matters for You and Your Family

When a company that holds customer, employee, or vendor records is hit by ransomware, the consequences reach far beyond the business itself. Your name, address, email, phone number, or financial details could be among the files now circulating among criminals. Once that information is loose, it can be sold, traded, or used to target you and your family with identity theft, phishing, or harassment. Internal files exfiltrated often contain spreadsheets, databases, or documents that link multiple pieces of personal data together, making follow-on attacks easier and faster.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently include email addresses, usernames, phone numbers, and notes that connect your online handles to your real identity. Criminals use these connections to build an identity chain: one leaked credential leads to another account, which leads to gaming profiles, family member details, or children’s accounts. A single breach like this can cascade into full doxxing, account takeovers, and persistent harassment. Public reporting describes how such chains allow attackers to map relationships across platforms that most people assume are unrelated.

Qilin Ransomware Group’s Known Track Record

Public reporting attributes the attack to the qilin ransomware group. The group emerged in 2022 and has since targeted organizations across multiple sectors. Notable prior victims include companies in healthcare, education, and technology. Their typical playbook involves gaining initial access through phishing or exploited vulnerabilities, exfiltrating data before encrypting systems, and then extorting victims by threatening to publish the stolen files on their leak site if ransom demands are not met. Available reporting describes qilin as operating a double-extortion model that combines encryption with data leakage.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this breach may have exposed.
• Rotate the password you used at CoreHQ anywhere it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next time your information appears it is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or parent credentials and become targets after leaks like this one.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The incident shows that even companies you may never have heard of can hold pieces of your personal story. Taking concrete steps now limits how far criminals can travel down the identity chain created by this and future breaches. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand and close the gaps this leak may have opened.