Hackers have targeted a local disability support organisation, with passports and confidentiality agreements already published on the darkweb.
A disability support organisation serving the Nepean and Hawkesbury regions is investigating a data breach after being listed by the Qilin ransomware group.
“We are aware of the allegations referred to in your correspondence,” the Thorndale Foundation told Cyber Daily after Qilin’s claims were put to it.
“The matter has been reported to the Australian Cyber Security Centre (ACSC) and relevant authorities and remains under investigation.
“As this process is ongoing, we are unable to provide any further at this time.”
One of Qilin’s affiliates posted details of the hack in a September 15 leak post. The hackers have not shared any details regarding the size of the compromised dataset, nor when the full set would be published.
Qilin has, however, shared six documents as evidence of the hack, including a pair of passport scans, a signed confidentiality agreement, an invoice, and a list of names linked to the Thorndale Foundation.
As of the time of writing, Qilin is the most active ransomware operation in existence, averaging 100 victim listings each month in 2026 so far. Since it was first observed in 2022 the group has notched up 2,306 victims
The group operates under a ransomware-as-a-service model, with affiliates gaining access to its ransomware infrastructure in return for a cut of any ransom payments.
Networking giant Cisco recently warned of Qilin activity targeting a vulnerability in its Secure Firewall Management Center software
The group’s Sydney-based app developer DigiGround, which was listed by the hackers last month .
Who is the Thorndale Foundation?
Based in Werrington, New South Wales, the Thorndale Foundation offers disability support services to the lower Blue Mountains, Nepean, and Hawkesbury regions.
The Foundation operates six group homes with four to five residents each, as well as employment support, disability day programs, and NDIS social group activities.
“Thorndale has over 200 participants, and is recognised in Western Sydney as a disability organisation of choice,” the organisation says on its website.
David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
