Die Linke Confirms Cyber Incident as Qilin Claims Data Theft
Summary
Germany’s Die Linke confirmed a cyber incident but said it is unclear whether data was accessed; its membership database was unaffected. Qilin claimed the attack and threatened publication, but posted no data samples.
Key points
- Die Linke disclosed a cyber incident on March 27; the party said the extent of any data access remained unclear.
- Qilin claimed the attack and listed Die Linke on its leak site on April 1, without publishing data samples.
- The party said attackers aimed to publish internal organizational data and employee information, but whether that succeeded is unknown.
- Die Linke stated that its membership database was not affected and that attackers failed to obtain member data.
- The party filed a police complaint and is working with independent IT experts to safely restore affected systems.
Article Details
- Victim Organization
- Die Linke
- Incident Type
- Ransomware incident with a claim of data theft and a threat to publish the data
- Data Types Exposed
- Sensitive information from internal party organization areas (potentially)
- Personal information of employees at party headquarters (potentially)
- Operational Impact
- The party said affected systems were being safely restored with help from independent IT experts. It reported that its membership database was not accessed.
- Ransom Or Extortion
- Qilin threatened to publish allegedly stolen data and listed Die Linke on its leak site on April 1. No ransom demand or payment was reported.
- Claim Status
- claimed
Threat Actors
ICE RELICMandiant reported that APT29 targeted Germany's CDU political party in a 2024 campaign using the WineLoader backdoor; this was described as a prior, separate incident.QilinDie Linke said it received information identifying Qilin as behind the attack, and Qilin publicly claimed responsibility and listed the party on its leak site. The party did not confirm whether or to what extent data was stolen.