The Rhysida ransomware group has published what it presents as a full network dump from DR.SCHNELL GmbH & Co. KGaA, a German chemical manufacturer. According to threat-intelligence aggregator QPulse, the dump went live on October 22, 2026 and contains 175,151 files totalling 2.52 TB. QPulse reports that it includes ERP backups, HR and payroll records for staff in three countries, the CEO's identity documents, TLS private keys and an Office 365 administrator password. One caveat matters for everything below. At the time of writing, every DR.SCHNELL-specific detail in this brief comes from a single source, QPulse, which has not been corroborated by a victim statement, a regulator filing or the established security press. DR.SCHNELL has not commented publicly in any of the material we reviewed. The details should be read as the leak-site claims as described by QPulse, not as facts the company has verified.
What Happened
QPulse says DR.SCHNELL was posted to Rhysida's leak site and discovered on October 22, 2026, and that the full data set was released the same day. QPulse rates the incident 95 out of 100 for severity. A full release usually means no ransom was paid, or that a negotiation deadline passed. Rhysida runs a double-extortion model: it steals data, encrypts systems, then threatens to publish (Dr. Web). It is not known whether DR.SCHNELL's systems were encrypted, when the intrusion began, or what ransom was demanded.
We also checked the Münnecke & Vollmers ransomware monitor. Its recent activity feed, which covers entries up to October 21, 2026, does not yet list DR.SCHNELL. That fits a same-day posting on October 22, but it means we found no second tracker confirming the listing.
For context, this comes weeks after Rhysida's most prominent German operation: the breach of two Berlin Senate departments, Urban Development/Building/Housing and Mobility/Transport/Climate/Environment. Accounts of that incident differ in the details:
- Volume: 5.79 TB and roughly 1.44 million files (Breached.Company, citing Security Affairs); about 5.8 TB and 1.44 million files (Dr. Web); about 1.4 million records (DW).
- Intrusion window: August 7 to 14 (DW); August 7 to 12 (Dr. Web).
- Publication: Breached.Company dates the leak-site post to August 28; Dr. Web says the data was published on September 4.
- Ransom: 30 bitcoin, about €2 million (DW, Dr. Web). Governing Mayor Kai Wegner publicly refused to pay.
Trackers also disagree on how many victims Rhysida has posted since 2023: 296 (Breachsense), 280 as of August 29 (Ransomware.live) and 265 as of February 2026 (Ransom-DB), as compiled by Breached.Company.
What Was Taken
According to QPulse, the 2.52 TB dump contains five categories of data:
- ERP data: more than 1.2 TB of Navision/Business Central backups covering commercial history, customer records, pricing and procurement.
- HR and payroll: records for employees in Germany, Switzerland and Austria, including home addresses, personal email addresses, payslips, social-security numbers and tax IDs. QPulse describes this as GDPR Article 9 data. Article 9 covers special categories such as health data, so that label may only apply to parts of the payroll material, for example sick-leave or health-insurance details. QPulse does not say which parts.
- Corporate and family-office finance: accounting records, signed annual statements, bank statements and a credit-line agreement worth €35 million.
- The CEO's personal file: a valid passport, ID card, tax ID and 11 years of signed tax returns.
- Access material: TLS private keys for *.dr-schnell.de, about 120 Elster tax certificates (Elster is Germany's electronic tax-filing system), an Office 365 admin password and several password lists.
No independent party has checked the contents, and QPulse does not say how many people are affected. This brief therefore gives no affected-individual count.
Why It Matters
The access material is what makes this dump especially dangerous, even more than the personal data. If QPulse's description is accurate, the leak creates four distinct risks:
- Impersonation: a stolen TLS private key for a wildcard domain lets an attacker pose as any DR.SCHNELL subdomain in man-in-the-middle or phishing attacks until the certificate is revoked. Browsers check revocation inconsistently, so the risk can outlast the revocation itself.
- Tax fraud: Elster certificates authenticate filings with German tax authorities. Around 120 of them in public circulation raises the risk of fraudulent filings or unauthorized access to tax accounts.
- Cloud takeover: an Office 365 admin password, even an old one, is a starting point for tenant takeover, mailbox access and invoice-redirection fraud against DR.SCHNELL's customers and suppliers.
- Downstream fraud: ERP pricing and customer data, together with the CEO's identity documents and signed financial records, give attackers what they need for convincing business email compromise and executive impersonation across the company's supply chain.
The breach also fits a pattern. Rhysida has hit a German state government and now a German manufacturer within about two months. Dr. Web argues that the attack techniques used against Berlin "have long been hitting the Mittelstand," Germany's mid-sized industrial companies. Breached.Company's analysis of Rhysida's victims shows education (56) and healthcare (41) as its main sectors, but the DR.SCHNELL listing shows manufacturing is also a target.
The Attack Technique
How Rhysida got into DR.SCHNELL has not been reported, and nothing in the sources links this intrusion to a specific technique.
Rhysida's recent German activity offers a reasonable working assumption, but it is not evidence about this case:
- Berlin entry point: DW and Dr. Web report that the Berlin breach began when an employee in the transport administration opened a phishing email.
- ClickFix lure: a Berlin news report (Headtopics), citing a Mastodon post by Germany's Federal Office for Information Security (BSI) and a Microsoft analysis, names the method as "TerminalFix," a ClickFix-style lure. Victims are shown a fake CAPTCHA and tricked into running a command in Windows Terminal or PowerShell.
- Undetected spread: according to Dr. Web, the malware then spread unnoticed for weeks until suspicious activity on a domain controller gave it away.
- Plaintext passwords: in Berlin, Rhysida also stole and advertised lists of plaintext passwords (Headtopics, Dr. Web). The password lists reportedly in the DR.SCHNELL dump suggest the group again targeted credential stores.
Rhysida operates as ransomware-as-a-service, renting its tools to affiliates (Dr. Web). The affiliate responsible for DR.SCHNELL may therefore use different methods from the one behind the Berlin attack.
What Organizations Should Do
- Revoke and reissue exposed certificates immediately. Any organization whose private keys may have leaked should revoke the affected certificates, generate new key pairs, and watch Certificate Transparency logs for unauthorized issuance on its domains. Partners of DR.SCHNELL should be wary of unexpected certificate changes or lookalike hosts on dr-schnell.de.
- Assume every leaked credential is live. Rotate all Microsoft 365 admin and privileged accounts. Audit the Entra ID tenant for new admin roles, OAuth app consent grants, mailbox forwarding rules and federation changes. Enforce phishing-resistant MFA on all admin accounts.
- Revoke tax and signing certificates. Organizations holding Elster or similar authentication certificates should keep an inventory of where those files live. If exposed, revoke them through the issuing portal and watch for unauthorized filings.
- Tighten payment verification across the supply chain. Customers and suppliers of DR.SCHNELL should confirm bank-detail changes and payment requests through a separate, known channel. The leaked pricing, procurement and executive data makes invoice fraud highly plausible.
- Defend against ClickFix-style lures. Block or alert on PowerShell and Windows Terminal being launched from browser processes. Limit the Win+R run dialog through policy where practical. Train staff that no legitimate CAPTCHA asks them to paste commands.
- Get credentials out of file shares. Search file servers and SharePoint for password lists, private keys and certificate files, and move them into a managed secrets vault. Watch domain controllers closely: in Berlin, suspicious domain-controller activity was the first sign of the breach.
Sources: Rhysida Ransomware Group Publishes 2.52 TB Data Dump from DR.SCHNEL... | xHealth Data Breach Affects 118,000 Individuals | Cyberattack in Berlin: 1.4 million files on the dark web | Ransomware-Monitor: Who's hacked? | BSI explains first attack vector on Berlin authorities - Cybercrime... | Rhysida Ransomware Tracker: 296 Victims Mapped Breached.Company | Berliner Datenleck: Was Firmen daraus lernen müssen? | CenterPoint reports customer data breach