Russian Man, 28, Named as Core Qilin Ransomware Member Detained in Osaka and Extradited to Germany; Group Claimed Asahi Attack
This article organizes publicly available information into a single account. Where it describes an arrest or an ongoing investigation, that reflects only one stage of criminal procedure and does not mean guilt has been established (the presumption of innocence applies). We will update this article as new information becomes available, including the outcome of prosecution, non-prosecution, or trial. This article is not intended to unfairly disparage any individual, group, nationality, ethnicity, or belief, and aims to provide objective, fact-based information.
A 28-year-old Russian national described as a core member of Qilin, a group that launches ransomware cyberattacks on companies around the world, was detained in Japan and handed over to German authorities. According to the Asahi Shimbun and other outlets, the man was detained by Japanese authorities while visiting Osaka in late May 2026 and was transferred to German authorities on October 2 under the Act of Extradition, following an extradition request from Germany.
He is suspected of illegally accessing the systems of a German logistics company in September 2024, encrypting its data, and extorting the equivalent of about 26 million yen in Bitcoin as ransom. He is described as a core member responsible for building the systems used in attacks, and investigators confirmed he received a share of ransom payments from attack operations. Qilin is the group that claimed responsibility for a cyberattack on Asahi Group Holdings, meaning its activity has also caused damage to companies in Japan.
Current status: The charges he faces in Germany, the outlook for trial, the full scope of Qilin's damage in Japan, and the state of investigations into other members remain unclear as of this writing. This article will be updated as further details emerge.
Update (October 8): German authorities disclosed by October 8, 2026 that Qilin had extorted roughly 4,000 companies and other organizations. According to TV Asahi, the official leading the investigation called the arrest "a historic success," noting that the group had attacked about 4,000 companies worldwide since 2024 and demanded 2.9 billion dollars (roughly 460 billion yen) in ransoms over four years, although actual payments amounted to about 6.3 billion yen. The interior minister of North Rhine-Westphalia said that "with the cooperation of Japanese police, we arrested one of the key figures." The detained Russian national had reportedly been planning to spend a vacation in Japan. This article will be updated as further details emerge.
Editorial Perspective
No decision on indictment has been made at this stage, so this article reflects information from the investigative phase. An arrest is only one step in criminal procedure and does not establish guilt (the presumption of innocence). According to National Police Agency and Ministry of Justice statistics, the number of Penal Code cases involving foreign nationals visiting Japan has risen for two consecutive years since 2023, but remains below its mid-2000s peak (related article). A single case does not necessarily reflect the broader statistical trend; further developments are worth watching.