Baden-Württemberg State Association for Prevention & Rehabilitation gGmbH Falls Victim to Brain Cipher Ransomware

🏢 About the Victim

The Baden-Württemberg State Association for Prevention and Rehabilitation gGmbH is a Germany-based non-profit and social organization focused on prevention, rehabilitation, and community health services. It operates under the domain bw-lv.de and is headquartered in Baden-Württemberg, Germany.

⚠ Disclaimer

This report includes actual screenshots and/or text that may contain unredacted personally identifiable information (PII) obtained from publicly available sources. Information is provided solely for cybersecurity awareness and threat intelligence purposes.

📌 Overview

On August 4, 2025, the Brain Cipher ransomware group listed the Baden-Württemberg State Association for Prevention and Rehabilitation gGmbH on their Tor-based leak site. The group claims to have exfiltrated approximately 1 TB of data, including databases, internal documents, and accounting records. Sample screenshots of file listings and the victim’s public statement have been posted to their leak portal.

📊 Key Details

Attribute	Information
Date	2025-08-04, 11:35:41 AM
Threat Actor	Brain Cipher
Victim Country	🇩🇪 Germany
Industry	Non-profit & Social Organizations
Victim Org.	Baden-Württemberg State Association for Prevention and Rehabilitation gGmbH
Victim Site	bw-lv.de
Category	Ransomware
Severity	Medium
Network	Tor

📥 Breach Snapshot

Field	Details
Data Types Leaked	Databases, internal documents, accounting data
Estimated Records	Approx. 1 TB of data
Public Statement	Posted on victim website
Leaked Screenshots	2 posted
Ransom Demand	Not disclosed

📡 Domain Reputation Summary

Check	Result
ASN	Hetzner Online GmbH
Country	🇩🇪 Germany
Name Servers	helium.ns.hetzner.de, hydrogen.ns.hetzner.com, oxygen.ns.hetzner.com
SSL Certificate	Valid, Let’s Encrypt
VirusTotal Score	0/94 (clean)