Rhysida claims to have stolen data from DR.SCHNELL GmbH & Co. KGaA

• Ransomware group: Rhysida
• Country: Germany
• Sector: Manufacturing
• Announcement date: October 22, 2026

Rhysida claims a massive data breach at DR.SCHNELL GmbH & Co. KGaA

The Rhysida ransomware group has posted a listing on its leak site claiming to have obtained a "full network dump" from the German manufacturing company DR.SCHNELL GmbH & Co. KGaA. According to the announcement made on October 22, 2026, the threat actor claims to have exfiltrated approximately 2.52 TB of data, consisting of 175,151 individual files. The listing provides a highly detailed breakdown of the stolen information, suggesting a deep penetration into the organization's internal systems.

Details of the claimed data theft

The information allegedly stolen by Rhysida is extensive and covers multiple critical business functions. The group claims to have access to a vast array of sensitive documentation, including more than 1.2 TB of Navision/Business Central ERP backups. These backups reportedly contain vital business intelligence, such as client lists, pricing structures, and procurement histories. Furthermore, the group claims to have accessed sensitive financial and administrative records, including bank statements and a credit-line agreement valued at EUR 35 million, as well as signed annual statements from related entities.

Beyond corporate financial data, the breach reportedly includes highly sensitive personal information. The listing claims to contain HR and payroll records for employees located in Germany, Switzerland, and Austria. This data allegedly includes home addresses, personal email addresses, and payslips containing social-security and tax IDs. Additionally, the group claims to possess long-term sick lists, which constitute special-category data.

The technical impact of the alleged theft appears significant, as the listing mentions the possession of critical digital credentials and certificates. This includes TLS private keys for *.dr-schnell.de, approximately 120 Elster tax certificates, an Office 365 admin password, and various other password lists. The listing does not reference any public statement from the company regarding this incident.

• ERP backups (client, pricing, procurement history)
• Employee payroll records (social-security and tax IDs)
• Employee health data (long-term sick lists)
• Bank statements and credit agreement
• Financial statements of related entities
• Executive identity documents and tax returns
• TLS private keys and tax certificates
• Admin password and password lists

About DR.SCHNELL GmbH & Co. KGaA

DR.SCHNELL GmbH & Co. KGaA is a Munich-based family company. The organization specializes in the manufacturing of professional cleaning, care, and hygiene products. According to the company profile, its operations and workforce extend across Germany, Switzerland, and Austria.

Analysis and potential implications

The level of detail provided in the Rhysida listing lends a degree of specificity to the claim, though the full scope of the incident cannot be independently confirmed without verification from the company. The nature of the data involved presents several high-risk scenarios. For instance, the inclusion of long-term sick lists—which are classified as special-category data under Article 9 of the GDPR—could trigger mandatory notification obligations to data protection authorities in Germany, Austria, and Switzerland, potentially leading to significant administrative fines.

The exposure of technical credentials such as TLS private keys, Office 365 admin passwords, and Elster certificates introduces direct operational risks. Such information could be exploited to create fraudulent websites, take over corporate email accounts, or perform unauthorized actions on tax portals. Consequently, rotating credentials and revoking compromised certificates is considered a critical defensive step in such scenarios. Additionally, the theft of ERP data containing client and pricing information could be highly valuable to competitors or fraudsters, while bank details could facilitate invoice and payment fraud.

Rhysida has been active since 2023 and is known to utilize double extortion tactics, where stolen data is used as leverage alongside encryption. The group is also known to auction stolen data to third parties, which increases the likelihood that the information may be sold on the dark web. In the manufacturing sector, organizations can mitigate these risks by implementing robust identity and access management, ensuring strict rotation of administrative credentials, and maintaining rigorous monitoring of ERP and financial systems.