Bavarian Municipal Utility Hit by Cyberattack, Disrupting IT Systems
Stadtwerke Landsberg, a municipal utility in Bavaria, Germany, has confirmed its internal IT systems were encrypted in a cyberattack that began on September 1, disrupting operations but not essential services.
A municipal utility in Bavaria has confirmed that hackers encrypted its central IT network in a cyberattack that began on September 1, disrupting office systems but not impacting essential services like electricity and water. Stadtwerke Landsberg, the city-owned utility, announced the incident on Monday, stating that it immediately disconnected the affected systems from the internet upon discovery.
The utility has activated its crisis management team and engaged external cybersecurity specialists to investigate the breach. While the attack involved encryption, Stadtwerke Landsberg has not yet identified a specific ransomware group responsible or confirmed whether an extortion demand has been made. The ongoing forensic investigation is being conducted by the external specialists.
Customers have been warned that staff availability via phone and email is limited due to the disruption. Furthermore, the utility cannot rule out the possibility that attackers accessed or stole personal data, including names, addresses, phone numbers, email addresses, and bank details. This potential data exfiltration adds a significant layer of concern for affected individuals.
Ransomware and other disruptive cyberattacks continue to pose a significant threat to German companies and public sector organizations. The Federal Office for Information Security (BSI) has consistently highlighted ransomware as one of the country's most serious cyber threats. This incident echoes a similar attack in late June that affected a municipal utility in North Rhine-Westphalia, which also led to weeks of system disruption and potential access to personal data from older backups.
The attack on Stadtwerke Landsberg occurred during a period of heightened security concerns in Germany. It coincided with the German government formally attributing a drone attack at Leipzig/Halle airport to Russia and reports of sabotage at two power substations elsewhere in the country. However, there is currently no indication that the Landsberg hack is connected to these other events.
Investigators are examining improvised devices found near one of the sabotaged substations in Brandenburg, which caused a short circuit but no major supply disruption. Separately, an attack at an Amprion substation in Rommerskirchen briefly took power-plant units offline without threatening grid stability. A 48-year-old man has since been arrested in connection with sabotage acts at power installations across Brandenburg, North Rhine-Westphalia, and Saxony.
Despite the proximity to other significant security incidents, authorities have stated there is no evidence linking the Stadtwerke Landsberg cyberattack to state-sponsored activities or the other physical sabotage events. The investigation into the cyberattack is proceeding independently, focusing on identifying the perpetrators and understanding the full scope of the compromise.
The incident underscores the persistent vulnerability of critical infrastructure to cyber threats. As utilities and public services increasingly rely on interconnected IT systems, they become attractive targets for malicious actors seeking to disrupt operations or extort funds. The ongoing investigation will likely focus on how the attackers gained access, the extent of data compromised, and the methods used for encryption.