Deutsche Welthungerhilfe

Deutsche Welthungerhilfe (WHH), a German charity focused on developing sustainable food supplies in impoverished countries, has been targeted by a ransomware gang. The ransomware-as-a-service (RaaS) group listed WHH on its darknet leak site and is attempting to sell stolen data for 20 bitcoin, equivalent to around $2.1 million. Although it is unclear if WHH’s computer networks were encrypted, the charity has confirmed it will not pay the ransom. Affected systems were immediately shut down, and external IT experts were called in to strengthen security measures. The charity has informed relevant authorities and continues to operate in its project countries, emphasizing the importance of its work in the face of global humanitarian crises.

Source: https://therecord.media/welthungerhilfe-german-hunger-relief-charity-ransomware-attack

TPRM report: https://scoringcyber.rankiteo.com/company/deutsche-welthungerhilfe

"id": "deu611070225",
"linkid": "deutsche-welthungerhilfe",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Non-profit',
                        'location': 'Germany',
                        'name': 'Deutsche Welthungerhilfe (WHH)',
                        'type': 'Charity'}],
 'attack_vector': 'Ransomware-as-a-Service (RaaS)',
 'data_breach': {'data_exfiltration': ['Data listed for sale on darknet']},
 'description': 'Deutsche Welthungerhilfe (WHH), a German charity, has been '
                'targeted by a ransomware-as-a-service (RaaS) group. The '
                'cybercriminals are attempting to sell data stolen from the '
                'charity for 20 bitcoin, equivalent to around $2.1 million.',
 'impact': {'data_compromised': ['Stolen data listed for sale on darknet'],
            'systems_affected': ['Computer networks possibly encrypted']},
 'initial_access_broker': {'data_sold_on_dark_web': ['Data listed for sale on '
                                                     'darknet']},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial gain',
 'ransomware': {'data_exfiltration': ['Data listed for sale on darknet'],
                'ransom_demanded': '20 bitcoin (approx. $2.1 million)',
                'ransom_paid': 'None'},
 'references': [{'source': 'Recorded Future News'}],
 'regulatory_compliance': {'regulatory_notifications': ['Informed relevant '
                                                        'data protection '
                                                        'authority']},
 'response': {'communication_strategy': ['Informed relevant data protection '
                                         'authority',
                                         'Consulted data protection officer'],
              'containment_measures': ['Affected systems shut down '
                                       'immediately'],
              'law_enforcement_notified': ['Police authorities'],
              'remediation_measures': ['Additional technical protective '
                                       'measures'],
              'third_party_assistance': ['External IT experts']},
 'threat_actor': 'RaaS group',
 'title': 'Ransomware Attack on Deutsche Welthungerhilfe (WHH)',
 'type': 'Ransomware'}