The founder of a German mobile phone repair and insurance biz has begun insolvency proceedings for some operations in his company after struggling financially following a costly ransomware attack in 2023.

Wilhelm Einhaus, who heads up Hamm-based Einhaus Group, confirmed the news to regional outlet [1]WA late last week.

The managing director said the company's financial failings were due to the public prosecutor's office refusing to return the stolen cryptocurrency tokens it paid the attackers.

[2]

Reportedly in the high six-figure range, authorities seized the ransom payment as part of their investigation into the cybercriminals, but the assets were never returned, Einhaus claimed.

[3]

[4]

"The fact that we, as the proven victims, are not recouping the extorted funds, even though they have been confiscated, has derailed our restructuring efforts," he said (machine translation).

Einhaus Group comprises 13 companies that Einhaus founded in the early 2000s. Three of these businesses have now started insolvency proceedings, including a mobile phone insurance company, a logistics business, and a 24-hour mobile phone repair service, which at one time was offered in more than 5,000 retail stores in Germany.

[5]

The business also partnered with major telcos such as Deutsche Telekom and 1&1, generating €70 million in annual revenues at its peak.

However, the [6]Royal ransomware group targeted the company in 2023, and Einhaus recalled walking into the office one morning to be greeted by reams of printouts indicating the attackers had control of his systems.

"We've hacked you. All further information can be found on the dark web," read the pages spewed out by every printer in the office, the managing director said. Staff were locked out of their computers and everyday business was halted.

[7]

The downtime that ensued, and the ransom payments made by the company, led to seven-figure losses in total, Einhaus said.

Einhaus aimed to recover the lost funds and revenue through various means, which included selling company property, liquidating investments, and reducing headcount from more than 100 to just eight.

Einhaus Group joins a long list of companies to have been hit by ransomware and later gone on to file for bankruptcy.

[8]As ransomware gangs threaten physical harm, 'I am afraid of what's next,' ex-negotiator says

[9]Ingram Micro confirms ransomware behind multi-day outage

[10]FBI: Watch out for these signs Scattered Spider is spinning its web around your org

[11]UK to ban ransomware payments by public sector organizations

In the same year Royal attacked Einhaus, a UK transportation company, Knights of Old, announced its collapse following an attack claimed by the Akira group. The business had existed for 158 years until then.

Ransomware was also [12]blamed for the demise of vodka giant Stoli's US arm. Two of its US subsidiaries faced $84 million in debts accrued in some part due to a ransomware attack in August last year, as well as a long-running legal feud with Putin, who branded the company as extremists for its support of Ukraine following the invasion.

Finnish psychotherapy clinic Vastaamo also went under in 2021 after its [13]patients were blackmailed using data that attackers stole from its systems a year earlier. ®

Get our [14]Tech Resources



[1] https://www.wa.de/hamm/hacker-richten-millionenschaden-in-hamm-an-und-stuerzen-firma-in-die-pleite-insolvenz-93845354.html

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aJDZCDSDfC_4SyVw9YQnSAAAAE0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJDZCDSDfC_4SyVw9YQnSAAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJDZCDSDfC_4SyVw9YQnSAAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJDZCDSDfC_4SyVw9YQnSAAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2023/11/14/us_confirms_royalblacksuit_ransomware_ties/

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJDZCDSDfC_4SyVw9YQnSAAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2025/07/31/ransomware_physical_harm_threats/

[9] https://www.theregister.com/2025/07/06/ingram_micro_confirms_ransomware_behind/

[10] https://www.theregister.com/2025/07/29/fbi_scattered_spider_alert/

[11] https://www.theregister.com/2025/07/22/uk_to_ban_ransomware_payments/

[12] https://www.theregister.com/2024/12/05/putin_ransomware_stoli_group/

[13] https://www.theregister.com/2024/04/30/finnish_psychotherapy_center_crook_sentenced/

[14] https://whitepapers.theregister.com/