German brewer Oettinger confirms cyberattack claimed by RansomHouse

Oettinger Getränke, one of Germany's largest beverage producers, confirmed in early May 2025 that it had been hit by a cyberattack. In a short statement the privately held company said it was investigating the intrusion and assessing whether data had been leaked.

The ransomware group RansomHouse claimed responsibility and listed the brewer on its darknet leak site. According to reporting by Heise, the group said it had penetrated Oettinger's systems on 19 April 2025, and the directories of copied files carried dates from the following day. The material RansomHouse published as proof included employee warning letters and internal business directories covering shipping and logistics, company locations, the vehicle fleet, warehouse management and quality systems.

Oettinger said production and logistics were not affected by the attack, although internal communications systems including email were temporarily disrupted. The company said it was investigating the incident together with IT forensic experts, the data protection authority and cybercrime specialists, and declined to give further detail while the forensic work continued, citing investigative reasons.

As of the reporting date the company had not said whether personal data was among the files taken, and no verified figure for the volume of stolen data had been published. Heise reported the incident on 6 May 2025 and Just Drinks reported Oettinger's public confirmation on 7 May.