The Qilin ransomware gang has reportedly stolen information from Die Linke, a German political party with a democratic socialist leaning, and is now threatening to make the stolen data public.

On March 27th, one day after their network was breached, the party announced a cybersecurity incident, though they did not initially confirm a data compromise.

Established in 2007, Die Linke (The Left Party) holds 64 seats in the German parliament (Bundestag). The party has 123,000 registered members and participates in several state governments, particularly in eastern Germany.

“According to what we currently know, the attackers are trying to release private information from within the party and personal data of the employees at the headquarters,” Die Linke stated.

“It is not yet known if they have succeeded, or to what degree. However, the possibility is there.”

The party clarified that their member database was not compromised, stating the attackers were unsuccessful in stealing membership details.

Die Linke has said that they believe the Qilin ransomware group is behind the attack, describing them as financially and politically motivated Russian-speaking cybercriminals. The German party added the attack on them “appears to be purposeful in this scenario.”

“These type of digital attacks is frequently a component of hybrid warfare and represents a threat to essential infrastructure,” the party expressed.

On April 1st, Qilin publicly claimed responsibility for the Die Linke attack, adding them as a victim on their online data leak platform, with no data released.

The threat of releasing data is a frequent tactic to force victims into paying a ransom.

Die Linke has informed German government agencies and reported a crime to the police, and is working with external IT experts to securely restore affected systems.

Political groups in Germany have been targeted by actors linked to Russia in the past. In 2024, Mandiant found a campaign from APT29 that was targeting CDU, a major political power, using a backdoor known as WineLoader.