Landeshauptstadt Stuttgart
The official designation for Stuttgart as the state capital of Baden-Württemberg, Germany; its municipal government was named on the Rhysida ransomware leak site on 19 May 2026.
Last refreshed: 20 May 2026 · Appears in 1 active topic
Does a Rhysida claim against Stuttgart's city hall create ransomware exposure for Porsche and Mercedes-Benz?
Timeline for Landeshauptstadt Stuttgart
Rhysida names Stuttgart on leak site
Cybersecurity: Threats and Defences- Was Stuttgart city council hacked in May 2026?
- Yes. The Rhysida ransomware group listed Landeshauptstadt Stuttgart on its leak site on 19 May 2026, threatening to publish exfiltrated municipal data. No German federal authority had issued a public response at the time of reporting.Source: DeXpose
- Why does a ransomware attack on Stuttgart matter for Porsche and Mercedes-Benz?
- Stuttgart is the global headquarters of both Porsche and Mercedes-Benz. A breach of the city's municipal government systems, which hold contracting, permitting, and employee data, creates a potential supply-chain exposure for both automotive OEMs even though their own IT infrastructure is separate from the city's.
- What is the Rhysida ransomware group?
- Rhysida is a ransomware-as-a-service (RaaS) crew operating the affiliate double-extortion model. It is considered a successor to the Vice Society operator lineage, targeting municipal governments, hospitals, and educational institutions across Europe.
Background
Landeshauptstadt Stuttgart is the official administrative designation for Stuttgart in its role as the state capital (Landeshauptstadt) of Baden-Württemberg, Germany's third-largest federal state by population. With a population of approximately 630,000, Stuttgart is one of Germany's most significant industrial cities: it is the global headquarters of Porsche AG and Mercedes-Benz Group AG, two of the largest automotive manufacturers by revenue, and home to the Messe Stuttgart trade-fair complex and Stuttgart Airport. The city's municipal government administers substantial digital infrastructure serving the local authority, public services, and utilities.
On 19 May 2026, the Rhysida ransomware crew listed the Landeshauptstadt Stuttgart on its data-leak site, threatening a double-extortion publication of exfiltrated municipal data. Rhysida operates the ransomware-as-a-service (RaaS) affiliate model, succeeding Vice Society in the same operator lineage. At the time of writing, no German federal authority had issued a public response, and no data publication had occurred. The incident places a ransomware claim against the municipal government directly upstream of the headquarters of two globally listed automotive OEMs: a breach of city-government systems that hold contracting, permitting, and employee data relevant to the companies headquartered there reads as a supply-chain exposure for Porsche and Mercedes-Benz, even if those companies' own IT infrastructure is separate from the city's.
The Stuttgart claim extends the cross-jurisdictional CNI picture built in the same week by the South Staffordshire Water ICO fine and the West Pharma SEC 8-K, adding a German municipal target to a pattern that spans UK water utilities and US pharma manufacturers. Germany has not yet enacted implementing legislation for NIS2 Directive obligations that would impose mandatory 24-hour notification on essential-service operators of Stuttgart's infrastructure class.
