Abyss

Profile narrative

Abyss is the alias used by a cybercriminal group that has been linked to a recent data breach in Germany. The group’s location is noted as Germany, although no further details about its organizational structure or headquarters are publicly available. Abyss came to public attention after claiming responsibility for an attack on a German solar energy provider. The group’s name appeared in communications related to the incident and in a leaksite posting that followed the breach.

On 14 July 2024 the IT systems of Hanwha Qcells, a German company that manufactures solar panels and supplies electricity, were compromised. Unauthorized third parties gained access to portions of the company’s customer and business partner databases. The exposed information included personal data such as names, addresses, telephone numbers, email addresses, passwords and financial account details. Hanwha Qcells confirmed the breach to the technology news outlet heise online and stated that it was working to restore the affected systems. The company also notified impacted customers and partners about the incident.

In early August the attackers posted an entry on their leaksite, threatening to publish the stolen data on 9 August if their demands were not met. The exact number of individuals whose information was taken has not been disclosed by either the company or the authorities. Despite the uncertainty surrounding the scale of the leak, the group’s involvement was explicitly attributed to Abyss in the official communications. State law enforcement and data protection officials, specifically the Landeskriminalamt and the Saxony‑Anhalt State Commissioner for Data Protection, have been engaged in the investigation.

Authorities have warned that the breach could lead to an increase in phishing attempts targeting those whose data may have been exposed. They also noted the possibility of credential‑stuffing attacks, where attackers try leaked username‑password combinations on other online services. Affected individuals are advised to change their passwords not only for the Hanwha Qcells online shop and Q Partner Portal but also for any other platforms where the same credentials might be reused. These precautionary steps are intended to reduce the risk of further compromise following the incident.

Incidents

Attributed incidents are available to members.