The Qilin ransomware group has listed Australian organisation Creative Universe (https://www.creativeuniverse.com.au) on its ransomware leak site, claiming it has fallen victim to the Russian-speaking cybercrime operation. The listing was published on 22 October 2026. Source
Evidence published on the leak site reportedly suggests that copies of passports and other confidential information have been obtained. This is similar to the recent Qilin listing involving Bathurst RSL, where evidence also reportedly indicated the theft of passport copies, invoices and confidential information.
As with all ransomware leak-site claims, the allegations should be treated cautiously until independently verified.
Who is Creative Universe?
Creative Universe is an Australian organisation based in Melbourne that helps businesses and communities develop leadership, innovation and organisational capabilities. Its services include leadership programmes, workshops, conferences, corporate events and entertainment.
A reminder: Do you really need to retain passport copies?
These claims highlight an important data protection issue for organisations: do you really need to keep copies of passports and other identity documents?
Passport copies contain highly sensitive personal information that can potentially be abused for identity fraud if exposed. Organisations should reconsider whether retaining these documents is necessary, rather than collecting and storing them by default.
Where identity verification is required, consider whether recording that verification was completed, or retaining only the minimum necessary details, would meet the business or legal requirement. If copies are genuinely required, they should be protected with appropriate access controls, encryption and retention limits, and securely deleted when no longer needed.
The less sensitive data an organisation holds, the less it has to lose in a breach.
