Qilin ransomware group claims breach of German political party Die Linke

The Qilin ransomware group has claimed responsibility for a cyberattack on Die Linke, a German democratic socialist political party, and is threatening to publish sensitive data allegedly stolen from its internal systems.

Die Linke disclosed the cyber incident on March 27, one day after its network was compromised, but has not confirmed that a data breach occurred. The party stated that attackers may have accessed internal organizational data and personal information belonging to employees at its headquarters, though the extent of any data exposure remains unclear.

Founded in 2007, Die Linke is represented in Germany’s federal parliament, the Bundestag, with 64 members and maintains a membership base of approximately 123,000. The party also participates in several state governments, particularly in eastern Germany.

The organization confirmed that its membership database was not affected, stating that attempts by the attackers to obtain member data were unsuccessful.

Die Linke identified the perpetrators as the Qilin ransomware group, describing them as Russian-speaking cybercriminals with both financial and political motivations. Party officials indicated that the incident may not be random, citing the broader context of politically motivated cyber activity.

The group publicly listed Die Linke as a victim on April 1 on its data leak site but has not released any samples of the allegedly stolen data. Such claims are commonly used by ransomware operators to pressure victims into paying a ransom.

The party has notified German authorities and filed a criminal complaint with police. It is also working with independent IT specialists to investigate the incident and restore affected systems securely.