Ransomware victim disclosure
← All victimsArwini
Claimed by kairos · listed 9 days ago
Status timeline
- Listed
May 11, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileArbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARWINI) is a registered association in Lower Saxony, Germany, operating within the statutory health insurance sector under SGB V. It serves as the joint audit and efficiency-review body bringing together the regional panel physicians' association (KVN) and statutory health insurers to oversee billing, care appropriateness, and efficiency of contractual outpatient medical services. Its work is administrative and regulatory in nature, handling formal procedures and consultations related to healthcare billing oversight.
- Industry
- Statutory Health Insurance Audit & Efficiency Review (Public Healthcare Administration)
- Address
- Lower Saxony, Germany
Attack summary
Severity: critical — ARWINI handles regulated healthcare and billing data pertaining to statutory health insurance under German SGB V, involving physician and patient-adjacent records. Data has been published, meaning confirmed exfiltration of sensitive regulated data in the healthcare/public administration domain, qualifying as critical under GDPR and sectoral health-data regulations.The Kairos ransomware group claims to have attacked ARWINI and has published data (disclosed status: data_published), indicating exfiltration of data from the organisation. No specific ransom amount or data volume was stated in the post.
Data the group says was taken
AI dossier — extracted from the leak post- Healthcare billing records
- Physician audit and inspection data
- Contractual outpatient care documentation
- Statutory health insurer correspondence
- Internal administrative procedures
What the group claims
Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARWINI) is a registered association in Lower Saxony, Germany, whose public role is to host the joint Wirtschaftlichkeitsprüfung setup for statutory health insurance under SGB V. It brings together the KVN (the regional association of panel physicians) and the health insurers in a shared inspection / audit structure for contractual outpatient care. Day-to-day work covers procedures, consultations with physicians where relevant, and formal processes linked to efficiency and appropriateness of care and billing. The brand ARWINI is the short name used in official documents and online; arwini.de is the domain commonly associated with that name. Operationally the body sits in the social health sector rather than ordinary consumer or tech markets.
Source
Indexed 9 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
