Ransomware attack on Welthungerhilfe

The cyber gang Rhysida has broken into Welthungerhilfe and copied data. Now the perpetrators want 20 bitcoins for it.

(Image: Screenshot Welthungerhilfe)

Jun 30, 2025 at 2:22 pm CEST

2 min. read

By

Dirk Knop

The non-profit organization Deutsche Welthungerhilfe e.V. has been the victim of a cyberattack. The aid organization confirmed this to heise online today. The perpetrators want to extort 20 Bitcoins. At the exchange rate at the time of reporting of around 91,825 euros, this corresponds to a ransom demand of around 1.8 million euros.

Darknet website of Rhysida with extortion note — On Rhysida's darknet site, the blackmailers indicate some of the copied data as copies of ID cards and demand a payment of 20 Bitcoin.

(Image: Screenshot / dmk)

The criminals are building up pressure to ensure that Welthungerhilfe has just over five days before the data is published. The extortionists don't care who the money comes from: “Take the opportunity to bid on exclusive, unique and impressive data. Open your wallets and be ready to buy exclusive data. We only sell to one person, no reselling, you are the only owner!”, they promise on the dark net.

Attack confirmed, situation still unclear

When asked by heise online, a spokeswoman for the organization explained that she can confirm the intrusion into the IT systems. “Unfortunately, it is not possible to determine the exact group of affected persons whose data has been leaked,” she continued, adding that the responsible data protection authority had been informed, and the police were already involved; the exchange with the authorities was close.

“The following personal data could potentially be impacted if we have received it from our supporters in the past: Name, address, date of birth, email address, telephone number; account details: IBAN and BIC as well as donation amounts,” explains Welthungerhilfe.

Videos by heise

Nevertheless, the IT incident had no impact on activities or aid projects. “All aid projects will continue,” the spokesperson explained. Welthungerhilfe received the ransom demand in the amount of 20 Bitcoins. The organization does not plan to respond to this extortion.

Attacks on state institutions or the healthcare system are now commonplace. However, blackmailing aid organizations is rare and demonstrates particular unscrupulousness. In early 2023, the cyber gang AlphV also attracted attention with unscrupulous actions. At the time, they broke into a healthcare network and subsequently published particularly sensitive material on the dark net. These included images of exposed breast cancer patients.