German beer powerhouse allegedly hit by ransomware, internal documents at stake

Ransomware gang has allegedly cracked open one of Germany’s largest breweries, Oettinger, claiming to hold a trove of sensitive data hostage.

A ransomware crew calling itself Ransom House says it’s hit Oettinger, the beer brand based in the Bavarian region that pours out and ships billions of bottles of beer and soft drinks a year.

The ransomware gang claims it has a goldmine of highly sensitive data. In a post on their dark web extortion site, the gang dropped a threatening message.

“Dear management of OeTTINGER Brauerei and Pia Kollmar. We are sure that you are not interested in your confidential data to be leaked or sold to a third party. We highly advise you to contact us,” write the crooks.

Sharing a warning on a gang’s website is a common technique used by cybercriminals to muscle organizations into paying the ransom. The attackers’ post went live on May 5th, but the gang claims they’ve been sitting on encrypted data since April 19th.

If confirmed, the attack could become a reason for major concern. According to samples reviewed by Cybernews, the stash includes internal documents dating from 2022 to 2025.

“The leaked internal documents could expose trade secrets, supplier contracts, employee data, and financial records, handing cybercriminals the perfect playbook for future attacks,” says Cybernews researchers.

“While the financial damage from breach response and potential ransom payments could run into the millions,” they add.

Cybernews has reached out to the company, but received no response as of yet. Oettingen Beverages is one of the largest drinks manufacturers in Germany and one of the top 25 breweries globally.

Headquartered in Oettingen in Bayern, the company boasts an annual revenue of over $420 million and has about 800 employees spread across sites in Oettingen, Mönchengladbach, and Braunschweig.

Ransom House isn’t new to the ransomware scene. The gang was first caught on the radar in December 2021. According to Cybernews’ dark web tracker Ransomlooker, the same gang has already listed 122 other victims on their leak site.

The gang has previously spread chaos in Spain when it targeted the Hospital Clinic de Barcelona, forcing medical staff to cancel thousands of medical appointments.