Arwini

Arwini was compromised in a ransomware attack attributed to kairos in May 2026. The organization, operating in an undisclosed sector in Germany, was added to the group's data leak site as part of an extortion campaign.

kairos operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARWINI) is a registered association in Lower Saxony, Germany, whose public role is to host the joint Wirtschaftlichkeitsprüfung setup for statutory health insurance under SGB V. It brings together the KVN (the regional association of panel physicians) and the health insurers in a shared inspection / audit structure for contractual outpatient care. Day-to-day work covers procedures, consultations with physicians where relevant, and formal processes linked to efficiency and appropriateness of care and billing. The brand ARWINI is the short name used in official documents and online; arwini.de is the domain commonly associated with that name. Operationally the body sits in the social health sector rather than ordinary consumer or tech markets.