Inotiv Hit by Qilin Ransomware Attack Following $35M Animal Welfare Fine
The Qilin ransomware gang has claimed responsibility for a cyberattack on Inotiv, a global pharmaceutical research conglomerate, disrupting operations and exfiltrating 176 GB of sensitive data. The breach, detected on August 8, forced Inotiv to take affected systems offline, though the company has not provided a timeline for restoration.
Qilin, a ransomware-as-a-service (RaaS) group known for double extortion tactics, alleges it stole 161,967 files, including financial documents, lab reports, research contracts, and employee records some dating back to 2018. The gang has not set a ransom deadline or indicated when it might leak the data if demands are unmet.
The attack comes just months after Inotiv was fined $35 million by the U.S. Justice Department for egregious animal welfare violations at its subsidiary, Envigo. In 2022, the Humane Society rescued over 4,000 beagles from Envigo’s Virginia facility, citing conditions that included maggot-infested food, denial of veterinary care, and nursing mothers being starved. The fine remains the largest ever under the Animal Welfare Act.
Inotiv, which employs 2,000 people across 22 locations in North America and Europe, reported $490 million in annual revenue in 2024. The company has engaged cybersecurity experts and law enforcement to investigate the breach, which has impacted internal data storage and business applications.
Qilin, active since 2021, has targeted 482 victims in the past year, ranking as the second-most active ransomware cartel in recent months. The group typically focuses on healthcare and manufacturing sectors, with past victims including energy firms and auto suppliers. Cybersecurity experts warn that organizations handling regulated or high-value research data must prioritize rapid containment, robust backups, and threat intelligence sharing to mitigate such attacks.
Inotiv’s breach underscores the growing risk to contract research organizations (CROs), which manage vast troves of proprietary data critical to pharmaceutical innovation. The incident follows a pattern of ransomware groups exploiting vulnerabilities in sectors with high-stakes intellectual property.
Envigo ++++ cybersecurity rating report: https://www.rankiteo.com/company/envigo-
Inotiv cybersecurity rating report: https://www.rankiteo.com/company/inotiv
"id": "ENVINO1770890587",
"linkid": "envigo-, inotiv",
"type": "Ransomware",
"date": "8/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Pharmaceutical, Contract Research '
'Organization (CRO)',
'location': 'North America and Europe (22 locations)',
'name': 'Inotiv',
'size': '2,000 employees, $490 million annual revenue '
'(2024)',
'type': 'Pharmaceutical research conglomerate'}],
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': '161,967 files',
'personally_identifiable_information': 'Employee records',
'sensitivity_of_data': 'High (proprietary research data, '
'employee records)',
'type_of_data_compromised': ['Financial documents',
'Lab reports',
'Research contracts',
'Employee records']},
'date_detected': '2024-08-08',
'description': 'The Qilin ransomware gang has claimed responsibility for a '
'cyberattack on Inotiv, a global pharmaceutical research '
'conglomerate, disrupting operations and exfiltrating 176 GB '
'of sensitive data. The breach forced Inotiv to take affected '
'systems offline, though the company has not provided a '
'timeline for restoration. The attack comes just months after '
'Inotiv was fined $35 million by the U.S. Justice Department '
'for egregious animal welfare violations at its subsidiary, '
'Envigo.',
'impact': {'brand_reputation_impact': 'Negative impact due to recent animal '
'welfare violations and cyberattack',
'data_compromised': '176 GB of sensitive data, 161,967 files',
'identity_theft_risk': 'Employee records compromised',
'operational_impact': 'Disrupted operations, systems taken offline',
'systems_affected': 'Internal data storage and business '
'applications'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain (ransom), Data exfiltration',
'ransomware': {'data_exfiltration': True, 'ransomware_strain': 'Qilin'},
'recommendations': 'Organizations handling regulated or high-value research '
'data must prioritize rapid containment, robust backups, '
'and threat intelligence sharing to mitigate such attacks.',
'references': [{'source': 'Cybersecurity news reports'}],
'regulatory_compliance': {'fines_imposed': 'Animal Welfare Act ($35M fine for '
'animal welfare violations)'},
'response': {'containment_measures': 'Affected systems taken offline',
'law_enforcement_notified': True,
'third_party_assistance': 'Cybersecurity experts engaged'},
'threat_actor': 'Qilin ransomware gang',
'title': 'Inotiv Hit by Qilin Ransomware Attack Following $35M Animal Welfare '
'Fine',
'type': 'Ransomware'}