Bathurst RSL Ransomware Attack: Qilin Claim, Club Reply - shattered.io

The Qilin ransomware group added Bathurst RSL to its leak site on October 22, 2026, with threat intelligence trackers confirming the listing that afternoon. Four days later, on October 26, Cyber Daily published an exclusive report in which the New South Wales club responded to the incident, though nobody outside the club has independently confirmed the club's claims.

HookPhish logged the listing at approximately 14:40 UTC on October 22, tagging the victim domain www.bathurstrsl.com.au as an Australian hospitality organization. Breachsense recorded the same event a day later, listing the threat group as Qilin and noting the leak size as unknown. SOCRadar and HackerFeeds both also carry entries for the club under Qilin, though none provide independent proof of intrusion.

Club's Response

Cyber Daily's report carries the only named-source response from the club. According to the outlet, Bathurst RSL Club confirmed it recently responded to a cybersecurity incident after Qilin named it as a data breach victim. The headline states the club reports the incident as contained, though this characterization has not been verified by any regulator, forensic firm or government agency.

The standfirst also claims that membership management systems were unaffected and that hackers shared passport scans and other personal data. The club has not publicly specified where the compromised files originated, though passport scans typically come from HR or accommodation booking systems rather than membership databases.

Hospitality Sector Vulnerability

Bathurst RSL operates as a hospitality and community entertainment organization running a licensed club with dining, live entertainment, event facilities, accommodation and community services. This creates a wide data footprint spanning membership records, staff files, supplier invoices, function bookings, guest registrations and payment data.

Smaller hospitality operators often maintain lean IT teams and outsource systems to managed service providers and software vendors, making them attractive targets. Attackers only need one exposed remote-access service, reused password or phished employee to compromise such organizations. Additionally, venues cannot easily afford to go offline, creating pressure to pay ransoms quickly.

Breachsense found 13 bathurstrsl.com.au email addresses in external breaches across 16 incidents, with 12 having plaintext passwords and the most recent incident dating to September 30, 2024. The vendor notes this credential exposure may not be connected to the current ransomware claim but highlights how common old, reusable credentials remain.

Qilin's Operations

Qilin operates a public leak site and employs a double extortion model, stealing data first, encrypting systems second, and threatening publication if victims don't pay ransom. According to Brandefense, Qilin has recorded 1,408 total victims with an average of 108.3 new victims per month, meaning the group posts a new name approximately every seven hours.

Australia has become a significant target for ransomware groups, with public-facing organizations facing thin budgets and high service expectations making them convincing targets. The Bathurst RSL incident follows a similar pattern to other claim-first incidents where verified details trickle in after initial gang announcements.