Qilin Ransomware Hits Bathurst RSL: A Warning for Central West Clubs
A ransomware gang has hit one of the Central West's best-known clubs. Bathurst RSL has confirmed it responded to a cyber incident after the Qilin group listed it as a victim and began leaking stolen files, including what appear to be staff passport scans.
Qilin added the club to its dark-web leak site on 22 October and published around 30 documents, with more expected within days. As Cyber Daily reported, CEO Peter Sargent said the club is aware of the claims, has engaged specialist cyber security experts, and that the incident is now contained with gaming and membership systems unaffected. The club says it has notified the relevant authorities and is contacting affected individuals directly.
Why Central West clubs should take note
Bathurst isn't a one-off. Qilin has spent 2026 working through Australian clubs and member-based organisations, with golf clubs, leagues clubs and co-ops all turning up on its leak site. Clubs make tempting targets: they hold a lot of personal data (member records, ID documents and payroll), run gaming and POS systems that can't simply go offline, and often run leaner IT than a corporate of the same size. To an attacker scanning for soft targets, a club in Bathurst, Orange or Dubbo looks exactly like one in Sydney.
"In regional clubs and NFPs across the Central West, we see the same pattern: lots of sensitive member data, systems that can't afford downtime, and backups nobody has actually tested. That mix is exactly what a ransomware crew is hunting for."
All IT ServicesWhat to do this week
- Test your backups, don't just run them. Keep an offline or immutable copy and actually try a restore. A backup you've never tested is a guess.
- Lock down remote access. Enforce MFA on every remote login, VPN and admin account, and close any remote desktop ports exposed to the internet.
- Patch internet-facing systems fast. Firewalls, VPNs and gaming or POS servers are common entry points, so keep them current.
- Write down an incident plan. Know who to call, how to isolate systems and your breach-reporting duties before you need them.
- Train your people. Most attacks still start with one convincing email, so team cyber safety training is cheap insurance.
Notifiable Data Breaches scheme, Office of the Australian Information Commissioner
Frequently Asked Questions
We are a small regional club. Why would a ransomware gang target us?
Because of what you hold, not how big you are. Clubs store member records, ID documents and payroll, run gaming and POS systems that cannot go down, and often run leaner IT than a corporate of the same size. To a gang like Qilin, a club in Bathurst or Orange looks the same as one in Sydney.
What is the single best protection against ransomware?
Offline, tested backups. If you can restore your systems and data without paying, ransomware becomes an outage instead of a disaster. The key word is tested: a backup you have never tried to restore is a guess, not a safety net.
If member or staff data is stolen, do we have to tell anyone?
Most likely yes. Under the Notifiable Data Breaches scheme, if a breach is likely to cause serious harm you must notify the affected people and the Office of the Australian Information Commissioner. Passport scans and member details absolutely count, so plan for this before it happens.
How fast can an attack like this actually happen?
Faster than most teams expect. Gangs often move from first access to encryption and data theft within a day or two. That is why prevention, monitoring and a ready incident plan matter more than hoping you will spot it in time.
Worried Your Club or Business Is the Next Target?
We'll review your backups, remote access and monitoring, and close the gaps ransomware crews rely on, before they find them for you.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →