Deutsche Welthungerhilfe: Ransomware gang attacks German charity that feeds starving children

Ransomware Gang Targets Deutsche Welthungerhilfe, Demands $2.1 Million for Stolen Data

Deutsche Welthungerhilfe (WHH), a German humanitarian charity providing emergency aid to 16.4 million people in crisis zones like Gaza, Ukraine, and Sudan, has fallen victim to a ransomware attack. The organization, which delivers food, water, and medical supplies to vulnerable populations, confirmed the breach to Recorded Future News after a ransomware-as-a-service (RaaS) group listed it on a darknet leak site.

The attackers are attempting to sell stolen data for 20 bitcoin approximately $2.1 million though it remains unclear whether WHH’s systems were encrypted. The charity has refused to pay the ransom, stating that affected systems were immediately isolated and external cybersecurity experts were engaged to mitigate the incident. Additional security measures have since been implemented.

WHH has notified data protection authorities, law enforcement, and its internal data protection officer while maintaining operations in its project countries. The charity emphasized that its humanitarian work remains unaffected, despite the ongoing global crises it addresses.

The RaaS group behind the attack has a history of targeting critical organizations, including hospitals such as Chicago’s Lurie Children’s Hospital and Prospect Medical Holdings, as well as the disability nonprofit Easterseals in 2023.

Source: https://therecord.media/welthungerhilfe-german-hunger-relief-charity-ransomware-attack

Welthungerhilfe (WHH) cybersecurity rating report: https://www.rankiteo.com/company/welthungerhilfe

"id": "WEL1770760502",
"linkid": "welthungerhilfe",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': '16.4 million people in crisis '
                                              'zones',
                        'industry': 'Humanitarian Aid',
                        'location': 'Germany',
                        'name': 'Deutsche Welthungerhilfe (WHH)',
                        'type': 'Nonprofit/Charity'}],
 'data_breach': {'data_exfiltration': 'Yes'},
 'description': 'Deutsche Welthungerhilfe (WHH), a German humanitarian charity '
                'providing emergency aid to 16.4 million people in crisis '
                'zones like Gaza, Ukraine, and Sudan, has fallen victim to a '
                'ransomware attack. The attackers are attempting to sell '
                'stolen data for 20 bitcoin (approximately $2.1 million). The '
                'charity confirmed the breach after a ransomware-as-a-service '
                '(RaaS) group listed it on a darknet leak site. It remains '
                'unclear whether WHH’s systems were encrypted.',
 'impact': {'data_compromised': 'Stolen data',
            'operational_impact': 'Systems isolated; humanitarian work remains '
                                  'unaffected'},
 'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial gain',
 'ransomware': {'data_encryption': 'Unclear',
                'data_exfiltration': 'Yes',
                'ransom_demanded': '$2.1 million (20 bitcoin)',
                'ransom_paid': 'No'},
 'references': [{'source': 'Recorded Future News'}],
 'regulatory_compliance': {'regulatory_notifications': 'Data protection '
                                                       'authorities notified'},
 'response': {'communication_strategy': 'Notified data protection authorities, '
                                        'law enforcement, and internal data '
                                        'protection officer',
              'containment_measures': 'Affected systems immediately isolated',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'Yes',
              'remediation_measures': 'Additional security measures '
                                      'implemented',
              'third_party_assistance': 'External cybersecurity experts '
                                        'engaged'},
 'threat_actor': 'Ransomware-as-a-Service (RaaS) group',
 'title': 'Ransomware Gang Targets Deutsche Welthungerhilfe, Demands $2.1 '
          'Million for Stolen Data',
 'type': 'Ransomware'}