12 OCT 2026 — Japanese police detained a 28-year-old Russian national suspected of being one of the leading members of the Qilin ransomware group and handed him to Germany, where he is now in custody. Germany and Japan have no bilateral extradition treaty.
The interior and justice ministers of North Rhine-Westphalia, the German state whose police led the case, announced the arrest on 7 October. Japan's National Police Agency confirmed its part the next day.
What North Rhine-Westphalia announced
Interior minister Herbert Reul and justice minister Benjamin Limbach presented the case in Düsseldorf. "This is a historic blow: for the first time we have successfully infiltrated such a network," Reul said, ZDF reported. According to the dpa news agency, he called it the biggest blow German investigators had ever landed against cybercrime.
The state's press notice said officers from the state criminal police office and its central cybercrime unit, ZAC, had infiltrated the group and watched it for months. It described the arrest as the first time a member of the network had been caught.
How investigators found him
The case began with a Qilin attack on a company in North Rhine-Westphalia in September 2024. According to ZDF, data was stolen and encrypted, and the attackers threatened to publish it. Investigators followed cryptocurrency payments and pieced together small details. "In the end there was a name behind the pseudonym," Limbach said.
The suspect is alleged to have built the systems used in attacks and to have received a share of the ransom, ZDF reported. Officials have not released his name.
Arrested in Japan, handed to Germany
German investigators learned he planned a holiday in Japan and alerted Japanese authorities, Reul said. "Instead of sushi, it is now cheese sandwiches in a German prison," he added.
The National Police Agency's statement says Japanese cybercrime investigators had been working with Germany on ransomware cases in Japan. When the suspect arrived in Japan, police worked with the Ministry of Justice and the Tokyo High Public Prosecutors Office to detain him under a provisional detention warrant, then handed him to Germany under Japan's extradition law. Germany held an arrest warrant for him over an attack in Germany.
The details that do not match
Accounts differ on where and when. Reul said the man was arrested in Tokyo in May and transferred to Germany "last Friday", which would be 2 October. The Record, citing a Japanese news report, said he was arrested at a hotel in Osaka in May and sent to Germany in June. The Japanese police statement gives neither place nor date.
How big Qilin is
Reul said Qilin had extorted almost 4,000 companies and institutions worldwide since 2024. Ransom demands added up to nearly US$3 billion, of which more than US$140 million was paid, according to the state police. Those figures cover the whole group. It works as ransomware-as-a-service, supplying malware and infrastructure to several hundred affiliate gangs that carry out attacks and share the proceeds.
Its victims include organisations across Asia. Qilin claimed the 2025 attack that disrupted the Japanese brewer Asahi, and earlier that year it hit Kuala Lumpur International Airport.
Still operating
One arrest has not stopped the group. BleepingComputer counted more than 450 victims added to Qilin's leak site since June, after the May arrest. The ministers withheld further details because the search for other suspects continues. "Our investigators are patient and forget nothing," Limbach said.
View author profile → · Editorial policy
