Millions Offered for Info on Cyberattacks; Suspected Hive Ransomware Leader on EU Most Wanted List

A significant reward is being offered for information leading to the capture of a key figure in global cybercrime, particularly the alleged leader of the notorious Hive ransomware group. The Cybercrime Centre (CCZ) Baden-Württemberg has placed the Ukrainian national high on the European "most wanted" list.

The suspect and his alleged accomplices are accused of using ransomware to steal and encrypt sensitive data from more than 300 companies globally. They then demanded substantial ransoms for the decryption and non-publication of this data. The total estimated damage from these attacks amounts to a high triple-digit million-euro sum. In Germany alone, the economic damage is estimated to exceed 50 million euros, according to the CCZ.

The arrest warrant details the Ukrainian's alleged involvement in nine ransomware attacks within Germany. In one instance, approximately 380,000 euros were paid. Victims include several companies from Baden-Württemberg. The Medizin Campus Bodensee hospital group was infiltrated by Hive ransomware in early 2022, leading to a temporary halt in patient admissions and diagnostic procedures at its Friedrichshafen and Tettnang locations due to encrypted data. The group demanded $100,000 in Bitcoin for decryption, but no payment was made, resulting in an estimated economic loss of 600,000 euros for the hospital.

Disturbingly, chat logs revealed discussions among Hive members about the ethics of targeting medical facilities. Despite initial debate, the group reportedly agreed to proceed with attacks on healthcare institutions. The police headquarters in Reutlingen took over the central investigation for Germany in 2023, leading to the dismantling of the cybercriminal network and the blocking of its dark web sites. Several suspects were subsequently arrested in Ukraine. Last year, authorities announced a European arrest warrant for the suspected mastermind behind one of the most aggressive and successful ransomware operations.