Clicks digital GmbH listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Germany
• Sector: Technology
• Announcement date: September 30, 2026

Rhysida ransomware group claims breach of clicks digital GmbH

The Rhysida ransomware group has recently listed the German technology company clicks digital GmbH on its dedicated leak site. According to the announcement made on September 30, 2026, the threat actors claim to have successfully infiltrated the organization's systems. This development suggests that the digital assets of the company may be at significant risk due to the alleged unauthorized access.

The group alleges that they have gained access to various internal systems and have obtained a variety of documents. This type of announcement is a common tactic used by ransomware groups to pressure organizations into meeting their demands. By publishing the names of victims on a public leak site, these groups aim to increase the visibility of the attack and create reputational pressure on the targeted entity.

Details of the alleged data leak

The information released by the Rhysida group includes screenshots that purportedly show sensitive documentation. The content of these images suggests that the breach involves highly personal and official records. Based on the available information, the following types of data are allegedly included in the leak:

• Identity card information
• Passport information
• Official correspondence
• Personal identifying information

The presence of such sensitive documentation, including national identity cards and passport-like documents, indicates a potentially severe compromise of privacy. When such information is exposed, it significantly increases the risk of identity theft and highly targeted phishing attacks against the individuals whose data has been compromised.

About clicks digital GmbH

Clicks digital GmbH is a digital marketing agency that specializes in managing online projects for a diverse range of clients. The company operates on both a national and international scale, handling complex digital strategies for various industries. With a workforce of over 40 employees, the agency has established itself as a specialist in the online marketing sector for more than twelve years.

The organization maintains a significant presence across Germany, with office locations in Berlin, Dresden, Munich, and Cologne. This widespread operational footprint highlights the potential impact of a data breach on their service delivery and client relations.

Implications and organizational risks

The alleged leak of sensitive personal information belonging to employees or clients presents several critical risks. For an organization operating within Germany, such a breach could potentially lead to legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). The exposure of identity documents and official correspondence is particularly concerning from a regulatory and compliance standpoint.

Rhysida is known for employing a double-extortion method. In this model, attackers do not just encrypt a company's data to disrupt operations; they also steal sensitive information to use as leverage. They threaten to release this stolen data on public platforms if the ransom is not paid, thereby attacking the organization's reputation and operational continuity simultaneously. This method forces companies to deal with both technical recovery and complex legal and public relations crises.

In response to such incidents, organizations typically face the obligation to fulfill data breach notification requirements. This involves informing the relevant regulatory authorities and the specific individuals whose data has been compromised. For companies in the technology and marketing sectors, maintaining robust cybersecurity frameworks is essential to mitigate these risks. Defensive measures often include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.