Captured Sep 5, 2026

Tanner

qilin

Ransomware leak-site victim intelligence

Files

Views

10,808

Posted

Sep 4, 2026

Country

Industry

Finance

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The group qilin claims 11 files were taken from Tanner (domain tanner.cl) in the finance sector. The leak post shows sample PNG images as evidence, with 11 PNG samples published. The publication is in countdown status (34 hours 24 minutes remaining), and the leak page provides an onion URL and TOX contact for the actor.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms: onion WikileaksV2 TOX
People named: Tanner

What was taken

Finance

File types seen

png × 11

Sample files (11)

81aec2d847d7fbe3d81f6811e955d117.png

26bffd9e816a7a4f3faa0cdf96c265c4.png

a6bcbffee303e73dee0aba2889bc44d9.png

8d709d4df7441188234f9479154119e6.png

f320ca4754958b9b60356bdecdfb948a.png

46994b060055da7f150ff9502cced995.png

16948c56206e2b94f2db9e281ecace07.png

12caebd707c7d8dd2292b42d42ac16e9.png

9cdfe2fb74e80a389c8ba2f2c7a9d42e.png

ecca3fe0ee285d9a4b35249504677821.png

e178fdce6d7d29526f5d211217df9933.png

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

onion_url: http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
tox_contact: TOX: 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
wikileaks_source: WikileaksV2

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Screenshot of a spreadsheet containing columns for ID, name, payment date, quota, commission, and other financial details.

onion leak page642 KB

Screenshot of a document titled "ACTA APROBACIÓN COMITÉ" with various sections including descriptions, percentages, and totals related to a financial assessment.

onion leak page273 KB

Screenshot of a credit application form with sections for client details, credit amount, and payment terms.

onion leak page257 KB

Screenshot of a KYC (Know Your Customer) form with personal and company details, including sections for identification and contact information.

onion leak page221 KB

Document titled "CERTIFICADO DE LIQUIDACIÓN" containing information about financial products and services, including a table of products and their details.

onion leak page292 KB

The image is a commercial profile document containing personal information, including name, nationality, date of birth, and property details.

onion leak page260 KB

Screenshot of a client application form with sections for company data, client benefits, and participant information.

onion leak page257 KB

Document titled "Solicitud de Incorporación y Certificado de Cobertura" with sections for personal and insurance details, including names, addresses, and policy information.

onion leak page229 KB

The image is a form titled "Estado de Situación" with sections for personal information, including fields for name, nationality, economic activity, and employment status.

onion leak page394 KB

The image contains a legal report titled "INFORME LEGAL" with sections detailing powers of attorney, including names, dates, and specific powers granted.

onion leak page176 KB

Negotiation

Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68

Onion http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion