Ransomware victim disclosure
← All victimsHeilmann GmbH
listed as Heilmann Gruppe · Claimed by Metaencryptor · listed 3 years ago
Status timeline
- Listed
Aug 16, 2023
- Data leaked
At a glance
- Group
- Metaencryptor
- Status
- Data leaked
- Country
- Germany
- Listed on leak site
- Aug 16, 2023
- Ransom demanded
- $134M
- Estimated revenue
- $134M
About the victim
AI dossier — public-source company profileHeilmann GmbH, headquartered in Büchen, Germany, is a family-run agricultural produce company specialising in the purchase, sale, and distribution of potatoes and onions. The Heilmann Gruppe encompasses Heilmann AG, Agricola, and Heilmann Logistics, covering farming, trading, and logistics operations. The group reported revenue of approximately $134 million in 2021.
- Industry
- Agricultural Produce Trading & Logistics (Potatoes & Onions)
- Address
- Parkstr. 1, 21514 Büchen, Germany
Attack summary
Severity: high — Data is marked as published (not merely listed), indicating confirmed exfiltration and public release of business data from a multi-entity group; while no regulated personal or medical data is explicitly confirmed, the scale of the organisation and published status elevates this to high.Metaencryptor claims to have attacked Heilmann Gruppe, with the disclosure status indicating data has been published; the group cites the company's $134M revenue figure, suggesting exfiltration of internal financial and business data. No specific data volume is stated in the post.
Data the group says was taken
AI dossier — extracted from the leak post- Financial records (revenue data)
- Business entity/corporate structure information
- Potentially operational logistics data
What the group claims
Heilmann Gruppe. The purchase and sale of potatoes and onions, as well as all related activities not subject to authorisation. The following companies belong to Heilmann Gruppe: Heilmann AG, Agricola, Heilmann Logistics. Revenue: $134M Year 2021
Sources
Source
Indexed 3 years agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
