Einhaus Group

The German mobile phone insurance, repair, and logistics company Einhaus Group suffered a severe ransomware attack in 2023, which led to significant financial losses and operational disruptions. The attack, by a group called 'Royal,' encrypted critical data, halting operations and causing millions in damages. Despite paying a €200,000 ransom in Bitcoin, the company's recovery was hindered when the seized crypto wasn't returned. This resulted in the company reducing its workforce from 170 to just eight employees and filing for insolvency for three of its companies, including 24logistics.

Source: https://www.techradar.com/pro/security/a-single-ransomware-attack-has-pushed-this-business-into-insolvency

TPRM report: https://scoringcyber.rankiteo.com/company/byaccuor

"id": "bya721080425",
"linkid": "byaccuor",
"type": "Ransomware",
"date": "8/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Mobile phone insurance, repair, and '
                                    'logistics',
                        'location': 'Germany',
                        'name': 'Einhaus Group',
                        'size': 'From 170 employees to 8',
                        'type': 'Company'}],
 'data_breach': {'data_encryption': True,
                 'type_of_data_compromised': ['Contracts',
                                              'Billing',
                                              'Communications']},
 'date_detected': '2023',
 'description': 'Einhaus Group, a German mobile phone insurance, repair, and '
                'logistics company, suffered a devastating ransomware attack '
                "in 2023. The attack, perpetrated by the 'Royal' ransomware "
                'group, encrypted critical data and halted operations, leading '
                'to significant financial losses and operational delays. The '
                'company paid a €200,000 ransom in Bitcoin, but despite '
                'investigators seizing the crypto, it was not returned to '
                'Einhaus. The company has since dwindled from 170 employees to '
                'just eight, filed for insolvency for three of its companies, '
                'and discontinued mobile phone repair services.',
 'impact': {'data_compromised': ['Contracts', 'Billing', 'Communications'],
            'financial_loss': 'Mid-seven-figure range',
            'operational_impact': 'Operations halted',
            'revenue_loss': 'Millions in revenue and operational delays'},
 'investigation_status': 'Three suspects identified, ransom-paid crypto seized '
                         'but not returned',
 'motivation': 'Financial gain',
 'ransomware': {'data_encryption': True,
                'ransom_demanded': '€200,000',
                'ransom_paid': '€200,000',
                'ransomware_strain': 'Royal'},
 'response': {'law_enforcement_notified': True},
 'threat_actor': 'Royal ransomware group',
 'title': 'Ransomware Attack on Einhaus Group',
 'type': 'Ransomware'}