Pennant Hills Golf Club Data Breach

Pennant Hills Golf Club, an Australian organization in the hospitality and tourism sector, has been listed as a victim by the Qilin ransomware group on their dark web portal. The listing, published on July 2, 2026, was identified via SOCRadar’s Dark Web Monitoring. This incident highlights Qilin’s significant activity targeting Australian entities and the hospitality sector. Qilin has been a highly active ransomware group, with a notable increase in claimed victims. Their targeting pattern frequently includes the business services, manufacturing, and consumer services sectors, with a concentration of victims in the United States, Australia, and the United Kingdom. Other recent targets of Qilin that share similarities with Pennant Hills Golf Club include organizations within Australia and the hospitality industry.

SOCRadar’s analysis of stealer-log telemetry for pennanthillsgolfclub.com.au did not yield any matching records in the queried dataset. However, this absence of evidence should not be interpreted as confirmation of no credential exposure. It is possible that credentials were exposed under an alternate domain, harvested against personal email aliases, or used and rotated before being indexed in the available data. The methodology employed by ransomware groups like Qilin often involves acquiring credentials from stealer logs obtained on underground marketplaces. These credentials are then used for initial access, such as logging into Microsoft 365, VPNs, or remote access portals, before deploying ransomware. Given Qilin’s high operational tempo, CTI teams are advised to maintain continuous monitoring and implement proactive credential hygiene measures, rather than relying solely on the absence of direct evidence in specific queries.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.