NIUS data leak July 2025: what was published and what you should do

In mid-July 2025, attackers took over the public website nius.de and posted a file of subscriber and purchase records. On 15 July, Julian Reichelt confirmed that the leaked subscriber data was genuine and that NIUS had reported the attack to the police. The company that runs the site, Vius SE & Co. KGaA, had already emailed the people in that file during the night of 14–15 July to say their data had been published.

Berlin’s data-protection authority later confirmed it received a breach report on 14 July 2025, that the security hole had been closed, and that those affected had been told. Newsrooms that opened the file described about 5,700 records with first and last names, email addresses (sometimes more than one per person), payment details — bank account numbers (IBANs) or partial credit-card numbers, plus card type and expiry — the subscription chosen, and, for some people, a physical address. Have I Been Pwned added the same dump in August 2026 and counted 6,090 unique email addresses. There is no sign of a second, separate leak.

Closing the hole does not pull the list back

Most reporting has treated this as a finished incident: the data is confirmed real, the company wrote to people, the authority was told, the hole is closed. All of that is true. It is also the least useful part of the story if your name might be in the file.

What was published is not a pile of anonymous emails. It is a named list of paying subscribers. For some of those people it also says where they live and how they pay. Anyone who saved a copy still has that list. An email from the company does not retract a public file.

The money detail is the immediate problem. A name plus an IBAN is enough for someone to try to pull money from a European bank account by faking a direct debit. Partial card numbers are harder to spend, but they make a follow-up message sound as if it comes from a real billing department.

The slower problem is the combination itself. Coverage that leads with “the vulnerability has been closed” leaves out what a stranger now holds: that this specific person paid this specific outlet, sometimes tied to a home address. That pairing does not expire when the website is patched.

What to actually expect

• If you were a paying subscriber, look back at 14–15 July 2025. The company says it emailed the people in the file that night. That email was the official notice. We cannot look up whether you were included, and a “not found” result on a public breach website is not proof that you were spared.
• Watch your bank statements for direct debits you did not approve. The published file included names together with IBANs. Unauthorized direct debits can usually be reversed if you catch them, but only if you notice them.
• Expect messages that mention NIUS, a subscription, a refund, or an “update your payment details” link. The senders may already know your name, your email address, what you bought, and part of how you pay. That does not make them the company.
• This will not have a clean ending. The same file was still circulating more than a year later, when Have I Been Pwned catalogued it. Occasional scam contact can continue. There is no second official recall.

What cannot be undone — and what still helps

The published records cannot be taken back. Names, email addresses, subscription type, payment details, and any home addresses that were in the file are out. No company, regulator, or website can delete every copy. Do not pay anyone who claims they can remove you from this leak.

If a home address was included, that fact is also permanent. You cannot unsay that this name, at that address, was a paying subscriber.

What still helps, in order:

• Your bank, first. Check statements for unfamiliar direct debits and reverse them quickly. Tell the bank that the IBAN you use was published in a claimed 2025 breach, and ask what extra checks they can put on new direct-debit mandates. If a card of yours was stored with NIUS, watch that card even if only part of the number was in the file.
• Ignore billing messages you did not start. Do not click payment links in emails or chats about this leak. If you need to change how you pay NIUS, open the site yourself rather than following a message.
• Shrink the rest of your public footprint, especially if an address may have been exposed. A leaked record is a few fields. It becomes far more useful to a stranger when it is joined to people-search and data-broker listings that add relatives, phone numbers, employers and previous addresses. Those listings, unlike the leaked file, can actually be removed. File opt-out requests on the main people-search sites that show you, and repeat that once or twice a year — the listings tend to come back.
• Tell the people who share your home if your address was in the notice you received, so unexpected mail, calls or visitors are not shrugged off as a mix-up.