Rhysida

Rhysida is a ransomware-as-a-service crew that emerged in 2023 as the operational successor to the Vice Society group, inheriting its affiliate model, double-extortion methodology, and preference for government, education, and healthcare targets. On 19 May 2026 Rhysida named Landeshauptstadt Stuttgart, the German state capital of Baden-Württemberg, on its leak site with a double-extortion data-dump threat. Stuttgart is the headquarter city of Porsche and Mercedes-Benz, placing the municipal-government breach directly upstream of two of Germany's largest automotive OEMs.

Rhysida had previously claimed the British Library in November 2023, a landmark attack that resulted in the publication of staff personal data, disrupted public access to catalogue services for months, and became a reference case for the UK's cyber resilience frameworks. The Stuttgart claim follows the pattern: a public-sector organisation with complex legacy IT environments, limited patching Velocity, and high-value data. The crew operates a ransomware-as-a-service model where affiliates Conduct intrusions and split ransoms with the core infrastructure operators.

The Stuttgart claim lands in the same reporting window as the West Pharma SEC 8-K and the South Staffordshire ICO fine, extending the cross-jurisdictional CNI exposure picture to a third actor category. Whether Rhysida follows through with a full data publication or the city pays to suppress will set the precedent for the next German municipal target. No German federal authority had issued a public response at the time of writing.