welldone.com.tw Listed by qilin Ransomware Group

On August 20, 2025, Taiwanese remittance company Welldone.com.tw appeared on the leak site of the qilin ransomware group, with internal files listed as exfiltrated. The breach affects anyone who has sent or received money through the service, including thousands of migrant workers and their families whose personal and financial records may now sit in attackers’ hands.

What's Publicly Reported from Reporting

Public reporting indicates that Welldone is Taiwan’s first licensed legal remittance provider for migrant workers. It received approval from the Financial Supervisory Commission in 2018 to run financial technology innovation experiments focused on cross-border transfers. The company’s systems were compromised in a ransomware incident, and attackers extracted internal documents before encrypting or threatening to publish them.

Exact victim count remains unknown, but the nature of the business means the exposed data likely includes names, addresses, phone numbers, bank details, remittance records, government identification numbers, and employment information tied to both workers and their employers. The files were posted on the qilin leak site, a dark-web portal used to pressure victims into payment.

Why This Matters for You and Your Family

If you or anyone in your household has used Welldone to send money home or receive wages, your personal information is now at higher risk. Criminals can combine these records with other leaks to open accounts in your name, file fraudulent tax returns, or sell your details on underground markets. For migrant workers supporting families abroad, the breach can expose not only your finances but also the identities and locations of relatives who depend on those transfers.

Children’s data is rarely isolated. A parent’s remittance record often links to a child’s name, school, or gaming username. Once one piece is public, the rest can unravel quickly.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at the first dataset. They map relationships between emails, phone numbers, usernames, and real-world identities to create detailed profiles. A remittance record that lists your Taiwanese phone number and your child’s Roblox or Free Fire username can be chained with earlier gaming leaks or social-media scrapes. The result is a complete picture that enables targeted doxxing, SIM-swapping, or extortion against you or your family members.

Credential leaks of this type frequently cascade into account takeovers on gaming platforms, email, and banking apps. What begins as a corporate ransomware incident can end with someone logging into your child’s game account, changing the password, and demanding payment to return access.

Qilin Ransomware Group’s Track Record

Public reporting attributes the attack to the qilin ransomware group. The group emerged in 2022 and has since hit organizations across healthcare, education, manufacturing, and financial services. Notable prior victims include several mid-sized companies whose employee and customer records were published after ransom demands went unpaid. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files over several weeks. They then encrypt systems and post samples on their leak site, giving victims a short deadline before full data publication. Extortion tactics combine threats of data release with offers to negotiate, though many victims report that payment does not guarantee deletion of stolen files.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the Welldone breach.
• Rotate the password you used at Welldone anywhere else it is reused, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours instead of months.
• Cover the entire household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become the next link in doxxing chains.
• Let remediation specialists handle takedown requests for any exposed personal records while you focus on securing accounts and talking with your family about safe online habits.

The Welldone breach is a reminder that corporate ransomware attacks quickly become personal when names, addresses, and financial trails are exposed. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. Start your DoxxScan trial today to regain control before the next leak surfaces.