Rhysida, the ransomware-as-a-service crew active since 2023, named Landeshauptstadt Stuttgart on its leak site on Tuesday 19 May 2026 with a double-extortion data-dump threat1. Landeshauptstadt is the official designation for Stuttgart as the state capital of Baden-Wuerttemberg, the German federal state that sits at the centre of the country's automotive industry. No German federal authority had issued a public response at the time of writing. Rhysida succeeds the Vice Society crew in the same operator lineage and has been active against European municipal targets continuously since 2023.
Stuttgart hosts the corporate headquarters of Porsche and Mercedes-Benz. A city-government breach exposes payroll, planning, permits, and supplier records that touch both companies' day-to-day operations, even without direct access to either OEM's own networks. Rhysida's standard tactic, double-extortion through encrypted exfiltration followed by leak-site publication, is the same pattern it has used against the British Library, Insomniac Games, and a string of European hospitals and councils.
Berlin published its NIS2 implementation law on 5 December 2025 with a 6 March 2026 registration deadline, but only around one-third of covered entities had registered by the cut-off, and the European Commission's parallel infringement proceedings against partial-transposition member states cover Germany. A municipal breach disclosed within the new statutory framework would be the first significant German test of the post-NIS2 incident-handling track. For automotive supplier risk Teams, the question is whether Stuttgart's vendor records form part of the exfiltrated set and how quickly the city will publish a scope.
