[ Ransomware claim · qilin · 24 Oct 2026 ]
Castle Howard Estate
The ransomware group qilin named Castle Howard Estate (United Kingdom) on its leak site on 24 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from Castle Howard Estate and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is Castle Howard Estate?
- What it does
- Castle Howard is a Baroque stately home in North Yorkshire, home to the Howard family for more than 300 years, and a family-owned estate business. Alongside the house, gardens and arboretum it runs gift shops, a farm shop, a garden centre, cafes, holiday cottages, a lakeside holiday park and caravan park, and a year-round events programme, as well as farming, woodland and let property.
- Based in
- Castle Howard, near York, North Yorkshire, England, United Kingdom
- Founded
- 1699 (construction of the house began)
- Size
- about 120 permanent staff, rising to about 200 with seasonal staff, and more than 250,000 visitors a year
- Who it serves
- Day visitors, members and holidaymakers who visit the house, gardens, shops and cafes or stay on the estate, as well as tenants of estate property and businesses that hire the house for events or filming.
[ Impact ]Who could be affected
Visitors, members and holiday guests could be affected if ticketing, booking or online shop systems were disrupted or if their contact or payment details were exposed. Staff, tenants and local suppliers who deal with the estate could also face disruption or targeted phishing.
In hospitality generally: Guests can face booking problems and phishing that uses their reservation details, and hotels and restaurants hold names, contact details and payment data.
[ The attacker ]About qilin
Qilin is a ransomware-as-a-service operation in which affiliates carry out attacks using the group's tools and leak site and keep most of each ransom payment. Affiliates typically steal data before encrypting systems and use the threat of publication to pressure victims, and the group has hit organisations in many sectors, including healthcare and education.
qilin has claimed 126 organisations in the last 30 days, most in United States, Germany and Mexico, and mostly in professional services, manufacturing and other. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations qilin has named
- United States
- Chile
- Malaysia
- Germany
[ What to do ]If you are a customer, partner or neighbour
- Be wary of emails or calls about bookings, memberships or refunds that you were not expecting, and check them using the contact details on castlehoward.co.uk.
- Watch your card statements for unfamiliar payments if you have bought tickets, stays or goods from the estate online.
- Do not open attachments or follow payment change requests that appear to come from the estate without confirming them by phone on a known number, particularly if you are a supplier or tenant.
- Use a unique password for your Castle Howard online account and change it if you have reused it elsewhere.
[ Similar claims ]Other hospitality organisations in United Kingdom
- byod
- iah6477
- majinahanashi