# The count had no names

2026-10-08

Japan's National Police Agency says Qilin has targeted 53 companies there, across factories, services, construction, hospitals, and schools. The names were not released. The breaches in the next paragraph are not that list.

Canonical: https://www.fabiocti.com/notes/the-count-had-no-names/
Author: Fabio Correia

Fifty-three is a count. It is not a victim list.

Kyodo, quoting National Police Agency officials today, says Qilin has targeted 53 companies in Japan. Manufacturing, services, construction, hospitals, and schools. The names were not disclosed. The group is described as active since about October 2022, with some 4,000 companies hit worldwide, and activity in Japan confirmed since April 2023. Asahi in 2025 is “believed to be” this group, which is a suspicion, not a attribution you can paste onto the 53.

The same piece then changes subject. A 28-year-old Russian man, found at a hotel in Osaka in May and held until he was handed to Germany earlier this month, is suspected of being a key member. The allegation Kyodo’s source gives is a 2024 crypto extortion of a German logistics firm. That is one person and one foreign case. It does not name any of the 53.

## What the next paragraph will be asked to do

Kyodo’s “recent cases” are a data leak at Times Car, about 6.6 million accounts and images of 1.6 million driver’s licenses, plus attacks on Daiwa Securities and the operator of Yakiniku King. Those sentences sit after the 53, not inside it. A briefing that turns “53 companies” into “Times Car plus Daiwa plus a restaurant chain, therefore 6.6 million licenses” has added three named incidents to a list the police refused to name.

If you are one of the sectors, the useful question is whether your name is in a report you can read, not whether your sector was in the sentence. Hospitals and schools in the count are why a parent will assume their clinic was hit. The agency did not say which hospital. Do not fill that blank from a leak site that posted a Japanese name this week.

The arrest explains the press conference. The unpublished names are the incident. Keep them apart.