EURORDIS Listed by qilin Ransomware Group

On October 14, 2025, the European Organisation for Rare Diseases, known as EURORDIS, appeared on the leak site of the qilin ransomware group. The organization, which supports millions of people across Europe living with rare diseases, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of individuals whose information may be exposed remains unknown, anyone who has interacted with EURORDIS — whether as a patient, family member, donor, employee, or partner — could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that qilin posted EURORDIS to its leak site on October 14, 2025. The data consists of internal files exfiltrated following a ransomware deployment. No specific volume of records or detailed list of data types has been publicly confirmed beyond the broad category of internal documents. The organization itself has not yet issued a public statement detailing the breach scope or timeline of initial compromise.

Why This Matters for You and Your Family

If you or someone in your family has ever shared personal health details, contact information, or financial data with EURORDIS, those details may now sit in a ransomware leak. Health-related records are especially sensitive because they can reveal diagnoses, treatment histories, and family medical patterns. Criminals routinely use such information for identity theft, insurance fraud, or targeted scams that feel deeply personal. Even if your name is not on the main patient list, a single shared email, phone number, or address can link you to the breach.

The Doxxing and Identity-Chain Risks

Stolen internal files often contain more than obvious personal data. They can include staff directories, partner lists, donor spreadsheets, email correspondence, and login credentials. Once these appear on a ransomware site, other criminals scrape them and begin building identity chains — linking an email from one breach to a username in another, then to a child’s gaming account or a family member’s social profile. Credential leaks like this one cascade into account takeovers that feel unrelated until it is too late. Gaming accounts belonging to you or your children are frequent targets because they often reuse the same passwords or recovery emails exposed in professional breaches.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group with emerging in 2022. The group has targeted hospitals, manufacturers, technology firms, and nonprofit organizations. Its typical playbook involves gaining initial access through phishing or exploited remote desktop services, exfiltrating data before encrypting systems, and then pressuring victims with a dual extortion tactic: threatening both data publication and operational shutdown. Qilin maintains an active leak site where it posts samples and deadlines for payment.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the EURORDIS breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Rotate any password you used for EURORDIS services anywhere else it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts often chained to the same family address or recovery email.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring platforms where your information has already spread.

The breach of EURORDIS shows how quickly sensitive health-related and personal information can move from a nonprofit’s servers into criminal hands. Taking concrete steps now limits how far that information can travel. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage includes children’s gaming accounts that frequently become targets once credential leaks like this one begin to cascade.