BRIEFRansomwarehighP68
Rhysida ransomware publishes German firm DR.SCHNELL
DR.SCHNELL GmbH & Co. KGaA
Detected22 October 2026 · 15:36 UTC
Rhysida listed the German manufacturing group DR.SCHNELL with a claimed 2.52 TB / 175,151-file network dump, including Navision/Business Central ERP backups and full HR-payroll data for Germany, Switzerland and Austria. The dataset reportedly holds home addresses, payslips, social-security and tax IDs plus health data, meaning high GDPR and identity-theft risk. Suppliers and partners across DACH should treat this as an active data-leak event.
CategoryRansomware
Severityhigh
Priority score68
Detected22 October 2026 · 15:36 UTC
Ransomware● 42
Akira publica a la editorial Bethany PressAkira claims Bethany Press International, a Christian book publisher and distribution services firm, and says it will upload 40GB of corporate data. The claimed material includes employee financial and personal records, customer information, financials and contracts. It is a mid-size US victim, so it ranks below regional incidents but illustrates the ongoing exfiltration pattern.Ransomware● 48
Akira publica a la alemana MedienwerkstattAkira added medienwerkstatt ag, a Thurgau-based media and communications provider in the education sector, threatening to release 130GB of corporate data including employee personal information. The volume of exfiltrated HR and client material makes follow-on phishing and business email compromise likely. It is a European victim, so relevance for LATAM defenders is contextual rather than direct.Ransomware● 55
Akira publica al laboratorio de patología AnnapathAkira claims Annapath, a surgical and cytopathology laboratory serving Maryland, Delaware, Pennsylvania, DC, Virginia and West Virginia, and threatens to publish 110GB of corporate data. Healthcare diagnostics providers hold sensitive patient and partner data, so the leak would expose clinical relationships and business records. Although outside Latin America, the playbook (VPN/credential abuse against mid-size providers) mirrors regional targets.Ransomware● 62
Ransomware Qilin publica a la española AirtificialThe Qilin group has added Airtificial, a Spanish engineering and robotics technology company, to its leak site. No file listing is shown yet, so the scope of exfiltrated corporate, client or project data is unconfirmed. As a listed Spanish supplier to industrial and public-sector programmes, its compromise can expose partner data and OT/engineering information.Ransomware● 60
Ransomware Everest publica a la consultora PwCThe Everest ransomware group added PwC, the UK-headquartered Big Four professional services firm, to its leak site. A breach of such a high-profile organization that serves governments and enterprises could expose confidential client data and create supply-chain risk. Worth tracking for potential downstream exposure to regional clients.Ransomware● 60
InCare Technologies amenazada con publicar datos en 72 horasActors claim to hold a database from InCare Technologies, a US healthcare-focused managed service provider, and posted a 72-hour countdown before public release. Extortion against an IT provider raises downstream supply-chain risk for its many healthcare clients. Treat as a credible ransomware/extortion alert and notify potentially affected customers.