Pennant Hills Golf Club Data Breach

Pennant Hills Golf Club, an Australian organization in the hospitality and tourism sector, has been listed as a victim by the Qilin ransomware group on their dark web portal. The listing, published on July 2, 2026, was identified via SOCRadar’s Dark Web Monitoring. This incident highlights Qilin’s significant activity targeting Australian entities and the hospitality sector. Qilin has been a highly active ransomware group, with a notable increase in claimed victims. Their targeting pattern frequently includes the business services, manufacturing, and consumer services sectors, with a concentration of victims in the United States, Australia, and the United Kingdom. Other recent targets of Qilin that share similarities with Pennant Hills Golf Club include organizations within Australia and the hospitality industry.

SOCRadar’s analysis of stealer-log telemetry for pennanthillsgolfclub.com.au did not yield any matching records in the queried dataset. However, this absence of evidence should not be interpreted as confirmation of no credential exposure. It is possible that credentials were exposed under an alternate domain, harvested against personal email aliases, or used and rotated before being indexed in the available data. The methodology employed by ransomware groups like Qilin often involves acquiring credentials from stealer logs obtained on underground marketplaces. These credentials are then used for initial access, such as logging into Microsoft 365, VPNs, or remote access portals, before deploying ransomware. Given Qilin’s high operational tempo, CTI teams are advised to maintain continuous monitoring and implement proactive credential hygiene measures, rather than relying solely on the absence of direct evidence in specific queries.