Ransomware group rhysida hits DR.SCHNELL GmbH & Co. KGaA
DR.SCHNELL GmbH & Co. KGaA — a manufacturing target operating in DE has been listed by the rhysida ransomware group on 2026-10-22. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | DR.SCHNELL GmbH & Co. KGaA |
|---|---|
| Threat Group | rhysida |
| Summary | DR.SCHNELL GmbH & Co. KGaA, a manufacturing organization in Germany, was listed by the rhysida ransomware group on its leak site on 2026-10-22. |
| Date of Breach | 2026-10-22 |
| Discovery Date | 2026-10-22 |
| Region | DE |
| Target Domain | — |
| Business Sector | Manufacturing |
| Severity | HIGH |
Claim by rhysida
DR.SCHNELL GmbH & Co. KGaA DR.SCHNELL GmbH & Co. KGaA � full network dump. 175,151 files / 2.52 TB.1.2+ TB of Navision/Business Central ERP backups - full commercial history (clients, pricing, procurement).Complete HR & payroll for Germany, Switzerland, Austria: home addresses, personal emails, payslips with social-security and tax IDs, long-term sick lists (GDPR Art. 9 data).Family-office accounting: signed annual statements of dozens of related entities, bank statements, a EUR 35M credit-line agreement.CEO's personal dossier: valid passport, ID card, tax ID, 11 years of signed tax returns.Access material: TLS private keys for *.dr-schnell.de, ~120 Elster tax certificates, O365 admin password, password lists. More
Posted by the rhysida threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Leak post (onion / Tor)
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?company=285
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.