[ Ransomware claim · qilin · 23 Oct 2026 ]
Aryza
The ransomware group qilin named Aryza (Argentina) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from Aryza and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is Aryza?
- What it does
- Aryza is a software provider for financial services, offering platforms for lending, credit, collections, debt recovery, debt management, insolvency and compliance. It began in 2002 as a case management system for Irish insolvency cases and now offers 21 products in five suites, including insolvency case management software widely used in the UK.
- Based in
- Dublin, Ireland, with its holding company Aryza Holdings Limited registered in London, England
- Founded
- 2002
- Size
- more than 500 employees worldwide and more than 1,650 clients
- Who it serves
- Its customers are businesses in regulated industries such as banks, lenders, creditors, debt advice providers and insolvency practitioners. Through these clients its systems handle cases of people and businesses in debt or insolvency in countries including the UK, Ireland, Germany, the Netherlands, Belgium, Canada, Australia and New Zealand.
Partners and customers it names publicly
- Experian, Strategic alliance established in 2020
- Deloitte, Named by Aryza among firms it has worked with
- Pollen Street, Investor
- Macquarie Capital, Investor
[ Impact ]Who could be affected
Insolvency practitioners, lenders and debt advice providers that rely on Aryza's software could face disruption to case handling if services were affected. Because its systems manage financial details of people in debt or insolvency, those individuals could be affected if client data were exposed.
In technology generally: Software and IT providers can become a way into their customers: an attack on one supplier can reach many businesses that use its products or services.
[ The attacker ]About qilin
Qilin, also known as Agenda, is a ransomware-as-a-service operation active since 2022 whose affiliates use double extortion, stealing data before encrypting systems, and can attack Windows, Linux and VMware ESXi. It was among the most active ransomware groups in the first half of 2026.
qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations qilin has named
- United States
- Chile
- Malaysia
- Germany
[ What to do ]If you are a customer, partner or neighbour
- Client firms should contact their Aryza account manager for confirmed information and review any integrations or API keys linked to Aryza services.
- Firms using Aryza products should watch for phishing that imitates Aryza support, invoices or software updates.
- Individuals with debt or insolvency cases should be cautious of unexpected calls or messages about their case and check them with their adviser or practitioner.
- Follow official statements from Aryza for confirmed information about any incident.
[ Similar claims ]Other technology organisations in Argentina
- thegentlemen