27,000 employees affected by a data leak at RTL Group

On 18 February 2026, RTL Group — one of Europe's largest broadcasting and content groups, operating television channels, radio stations and production studios across Western and Central Europe — was named as the victim of a data leak after a threat actor claimed on a cybercrime forum to have breached the company's internal intranet.

The attacker advertised an internal employee directory said to contain records for more than 27,000 current and former staff across RTL Deutschland, Fremantle and RTL Studios. The exposed dataset was described as covering:

• Full names and job titles
• Work email addresses and physical office addresses
• Work and, in some cases, personal phone numbers
• Internal system IDs and account-provisioning details
• Organizational department names

Because RTL is a media conglomerate, security researchers flagged that exposing the contact details of journalists and reporters carries an elevated risk of targeted phishing, social engineering, harassment or spyware campaigns against investigative staff.

RTL Group acknowledged that it was aware of the attacker's claims and said it was investigating. According to the group, based on current findings it considered it unlikely that customer data had been compromised, though the investigation remained ongoing at the time of reporting.