A man believed to be a core member of the Qilin ransomware group, which targets companies worldwide, was arrested and extradition proceedings were initiated after he acknowledged causing damage to 53 companies, schools, hospitals and other organizations in Japan. German authorities arrested the man, and it also emerged that Japanese law enforcement had obtained information that he had entered Japan.
A Japanese male believed to be a core member of the Qilin ransomware group, which encrypts data at companies worldwide and demands ransoms, was the subject of an arrest warrant issued by German authorities and was extradited abroad. Japanese authorities said he had been detained in Osaka.
The National Police Agency announced that domestic damage had affected 53 companies, schools, hospitals and other organizations from April 2023 through the end of September this year. The number of affected companies worldwide is reportedly approximately 4,000.
According to the National Police Agency, Qilin carried out attacks by placing multiple operatives under its "core members," including those involved in developing the malware. The man is believed to be one of the core members, and the full extent of the damage in Japan is expected to become clearer as the investigation proceeds.
The investigation was conducted jointly by the Tokyo Metropolitan Police Department, the Osaka Prefectural Police and the Kyoto Prefectural Police. It was also announced that they had obtained information in advance that the man had entered Japan. His extradition to Germany was carried out in accordance with procedures under the Extradition Act.