(Image: heise medien). The criminal organisation Rhysida claims to have breached the City of Stuttgart and copied sensitive documents from its IT systems. The online gang is attempting to extort ransom. Stuttgart is currently investigating the claims. In total, Rhysida is currently running a seven-day countdown on its darknet site. During this time, “exclusive, unique and impressive data” from the state capital Stuttgart is for sale. Interested parties will need to pay 5 Bitcoin, which at the current rate corresponds to around 333,000 euros. The criminals promise to sell the data only once, so buyers would be the sole owners.
On the detail page on the darknet for the Rhysida attack, there are only a few, moreover heavily downscaled images of scanned and photographed documents, invoices and faxes. The scope and potential sensitivity of the data cannot really be inferred from this.
City of Stuttgart investigates. In response to a query from heise online about the alleged attack, a spokesman for the state capital of Baden-Württemberg remains rather tight-lipped. “The published claims are currently being examined together with the responsible authorities. According to current information, the City of Stuttgart has no evidence of a cyber incident. Further information cannot be provided at this time in view of ongoing investigations.”
The attack apparently appears to be limited. The city’s website [1] remains easily accessible. Communication is also possible. It also appears that no data was encrypted, as was common in earlier ransomware attacks.
The cybercriminal gang Rhysida has been active for years; in 2023, for example, the British Library fell victim to them [2], which subsequently had to cope with weeks of downtime. At that time, encrypting data was often observed – although the Rhysida gang made beginner’s mistakes in implementing the encryption, which allowed South Korean IT researchers to develop a free decryption tool [3] and make it available. Last year, the gang also attacked the German charity Welthungerhilfe [4] and stole data there as well – at that time, the gang demanded 20 Bitcoin, four times as much as now from Stuttgart.
(dmk [6]). URL of this article:
https://www.heise.de/-11301736
Links in this article:
https://www.stuttgart.de/
https://www.heise.de/news/British-Library-Wochenlanger-Ausfall-wegen-Ransomware-Angriff-9534532.html
https://www.heise.de/news/Ransomware-Forscher-decken-dummen-Krypto-Fail-auf-und-veroeffentlichen-Decryptor-9626575.html
https://www.heise.de/news/Ransomwareattacke-auf-Welthungerhilfe-10464644.html
heise security PRO
mailto:dmk@heise.de
Copyright © 2026 Heise Medien
heise security News