A Russian national identified as a core member of ransomware group Qilin was detained in Osaka and extradited to Germany via Japanese investigative authorities. The group has also previously claimed responsibility for an attack on Asahi Group.
Japanese investigative authorities detained in Osaka a Russian national identified as a core member of ransomware group Qilin and extradited him to Germany. The action followed a request under the Extradition Act, and the transfer was completed after a review by the Tokyo High Court.
The charges against the man concern the alleged illegal access to the systems of a logistics company in Germany in September 2024, the encryption of its data and the extortion of bitcoin worth approximately ¥26 million in return. The man was a core member responsible for building the ransomware attack infrastructure, and it has also been confirmed that he received part of the ransom extorted by the group’s operational unit.
Qilin is an internationally influential attack group that, in Japan, posted a claim of a major attack on Asahi Group Holdings in September 2025. The attack compromised the company’s internal network, forcing 30 factories and 6 breweries in Japan to temporarily suspend operations. It also caused secondary damage, including shipment delays, to the e-commerce platforms of business partners.
The company reported that more than 1.5 million records of personal information relating to employees, business partners and others had been leaked in the attack attributed to the group. The detention and extradition were made possible by the functioning of information-sharing and mutual legal assistance frameworks, amid strengthened cooperation among international investigative authorities, particularly those in Japan and Germany.