Die Linke ransomware breach

Qilin claims a ransomware attack on the German party Die Linke; the party has not confirmed data theft

Die Linke detected a cyberattack on its IT network on Thursday, 26 March 2026, took parts of its IT infrastructure offline as a precaution and filed a criminal complaint. In a statement the next day it said it had indications of a ransomware attack by the Qilin group and that its member database was not affected (Die Linke, 2026-03-27). Heise reported that it had not yet been definitively clarified which internal data had been compromised (Heise Online, 2026-03-27). Qilin added the party to its leak site on 2026-04-01 without publishing data samples (BleepingComputer, 2026-04-03). Contradiction: BleepingComputer's headline says the party confirmed the data theft, while its own text says the party stopped short of confirming a data breach (BleepingComputer, 2026-04-03). The party says the attackers aim to publish sensitive internal data and personal information of headquarters staff, and that it cannot assess whether or to what extent this will succeed or has already happened (Die Linke, 2026-03-27).

The sources give no access vector, so the transferable ground is the target class: German political parties have been targeted by cyberattacks before (The Record, 2026-04-06), and Die Linke describes ransomware attacks as often part of hybrid warfare and this one as aimed at weakening democratic structures (Die Linke, 2026-03-27).