The Qilin ransomware group has listed Brazilian pharmaceutical company Roxfarma as a new victim, according to threat intelligence reports published on 7 and 8 November 2026. The claim appeared on the group's leak site on 7 November and was picked up by the Ransomware.live tracker at 18:28 UTC that day.

The listing is an unverified claim by the attackers, not a confirmed breach. Neither report publishes evidence that Roxfarma's systems were encrypted, that data was stolen, or that a ransom was demanded. The trackers also differ on the company's sector: one lists Roxfarma under healthcare, another under manufacturing, so that detail should be treated with care.

What the reports do agree on is the trail behind the listing. The compromise was identified through infostealer activity detected by HudsonRock, and an exposure report from ParanoidLab records 219 exposed passwords, including 28 marked critical, along with 23 cookies and five third-party employee credentials. Roxfarma is reported to use Microsoft 365 services.

Roxfarma has not publicly confirmed an incident, and neither report gives technical details of how the attackers first got in. Organisations connected to the company should treat the listing as an early warning: check for exposed credentials, reset any that match, and watch for follow-on phishing using the stolen details. The claim adds to a busy November for Qilin, which has listed a string of new victims across several countries in the past week.

[Source: qpulse.quasarcybertech.com](https://qpulse.quasarcybertech.com/news/8006/qilin-ransomware-group-claims-attack-on-roxfarma) | [Source: undercodenews.com](https://undercodenews.com/qilin-claims-roxfarma-as-new-manufacturing-sector-victim-while-rhysida-targets-brazilian-justice-system-video/)