Which ransomware group was responsible for the Welthungerhilfe attack?

The attack was carried out by the Rhysida ransomware group, who demanded 20 Bitcoin in ransom (approximately €1.8 million) and set a five-day deadline, threatening to publish the stolen data if their demands are not met.

What is the ransom demand for the Welthungerhilfe attack?

The Rhysida group requested 20 Bitcoin in ransom, which was approximately €1.8 million at the time of reporting. They set a five-day deadline and are threatening to publish the stolen data on their dark web platform, offering it for sale to the highest bidder.

What type of data was compromised in the Welthungerhilfe breach?

The exposed data includes names, addresses, dates of birth, email addresses, telephone numbers, account details (IBAN and BIC), donation amounts, and copies of identification documents of individuals associated with the organization.

How many people were affected by the Welthungerhilfe ransomware attack?

The number of affected individuals has not been disclosed by Deutsche Welthungerhilfe e.V. or the authorities investigating the incident.

What is Deutsche Welthungerhilfe e.V.?

Deutsche Welthungerhilfe e.V. is one of Germany's largest private humanitarian aid organizations, providing humanitarian assistance and development aid to communities in need around the world.

How is Welthungerhilfe responding to the ransomware attack?

The organization has confirmed the incident and is cooperating with authorities to investigate the attack and respond appropriately to the security breach.

What is the Rhysida ransomware group?

Rhysida is a cybercriminal ransomware group that encrypts victims' data and demands payment for decryption keys. They typically threaten to publish stolen data on dark web platforms and sell it to the highest bidder if ransom demands are not met within their specified deadlines.

What should donors and supporters of Welthungerhilfe do?

Individuals who have donated to or are associated with Welthungerhilfe should monitor their financial accounts for suspicious activity, be cautious of phishing attempts using their compromised information, and consider updating passwords for any accounts that may have used similar information.

Are financial details like bank accounts at risk?

Yes, the compromised data includes account details such as IBAN and BIC numbers. Affected individuals should monitor their bank accounts closely for unauthorized transactions and consider contacting their banks to report the potential compromise of their account information.

What makes this attack particularly concerning?

This attack is particularly concerning because it targets a major humanitarian organization, potentially affecting donors and aid recipients. The compromised data includes sensitive financial information, identification documents, and donation records, which could be misused for identity theft or fraud.

How do ransomware groups typically operate after stealing data?

Ransomware groups like Rhysida typically set deadlines for payment and threaten to publish stolen data on dark web platforms if demands are not met. They often offer the data for sale to other criminals, potentially leading to further exploitation of the compromised information.

What should people do if they think their data was compromised?

Individuals who believe their data may have been compromised should monitor financial accounts and credit reports for suspicious activity, be vigilant for identity theft attempts, update passwords for online accounts, and consider placing fraud alerts with credit monitoring agencies. They should also be cautious of phishing attempts that may use their stolen personal information.

Incident

German aid organization Welthungerhilfe hit by ransomware attack

published: July 1, 2025

Learn More

Deutsche Welthungerhilfe e.V., one of Germany's largest private humanitarian aid organizations, has been hit by a ransomware attack claimed by the Rhysida cybercriminal group.

The incident was confirmed by Welthungerhilfe representatives. The organization is cooperating with authorities.

The attack was carried out by Rhysida, who requested 20 Bitcoin in ransom (approximately €1.8 million on the day of reporting). The hackers set a five-day deadline and threaten to publish the stolen data. On their dark web platform, the attackers are offering it for sale to the highest bidder. Exposed data includes:

Names
Addresses
Dates of birth
Email addresses
Telephone numbers
Account details (IBAN and BIC)
Donation amounts
Copies of identification documents

The number of affected individuals is not disclosed.

Despite the severity of the security breach, Welthungerhilfeclaims that their humanitarian operations remain unaffected, with all aid projects continuing as planned without disruption.

German aid organization Welthungerhilfe hit by ransomware attack

Read More
Medical device manufacturer PRC-Saltillo reports data breach exposing …
Whitworth University Notifies 65593 Students of SSNs exposed …
OneBlood blood bank hit by ransomware attack, disrupts …
Wexford County, Michigan, reports ransomware attack on election …
Albyn Housing Society hit by ransomware