Palau: Qilin ransomware gang claim responsibility for cyberattack on the Ministry of Health and Human Services
On 18 February, the Ministry of Health and Human Services (MHHS) issued a statement regarding a ransomware attack which disrupted several operations including pharmaceutical services. The attack compelled staff to manually retrieve patient records and delayed medical services. An MHHS IT specialist disclosed that the department was uncertain about the total information stolen by hackers although it had retrieved its data. Following the attack, Palau’s President, Surangel Whipps Jr., warned of increasing cyber activity targeting government agencies. President Whipps urged an increased budget for the Ministry of Finance to expand staffing and bolster security efforts and provide technical support to government agencies.
Assessment: The Qilin ransomware gang claimed responsibility for the MHHS cyberattack. It was the fourth cyberattack on a Palau government agency in less than a year. The name 'Qilin', associated with a Chinese mythological creature, suggests a Chinese origin, but members of the gang have been observed communicating in Russian on hacking forums. The Ministry of Finance’s Financial Management System, ASYCUDA (Bureau of Customs and Border Protection), and the National Development Bank of Palau were targeted in earlier attacks. An investigation into the Ministry of Finance’s attack was traced to Malaysia, with potential links to Russia or China. Palau is among the 12 nations that recognise Taiwan and has faced ongoing pressure from China as a result (see SPI #8, 7-20 November 2025).
Sources: Leilani Reklai, “Cyberattacks on the Rise in Palau, Whipps Stresses Need for Stronger Recovery Systems,” Island Times, February 21, 2025; “Cyberattack disrupts service at Ministry of Health,” Island Times, February 18, 2025; David Hollingworth, “Exclusive: Qilin ransomware gang claims hack of Palau Ministry of Health and Human Services,” Cyber Daily, February 21, 2025.
