Hackers copy Eichstätt city data to a server abroad

Hackers copied data from Eichstätt’s city administration to a server abroad during a ransomware attack, BR reports. The authorities have not yet established exactly what information was taken, but the city’s mayor suspects personal data may be involved.

The Bavarian State Criminal Police Office found that the copied data is stored on a server outside Germany. Investigators have established that the attack took place overnight from October 8 to 9 and involved ransomware, which encrypts data and systems to extort money. The attackers also copied data, and the city estimates that a large share of its stored information was affected.

Mayor Josef Grienberger said the city expects initial findings on the data early next week. He believes information about residents may be among the files. The city is warning people about the risk that the attackers could publish the data or misuse it. The administration says it has not received an explicit ransom demand.

Investigators believe the attackers probably gained access through a software vulnerability. They have ruled out a phishing attack, such as a malicious link sent by email, and see no specific political motive. The city believes it was targeted at random. An international investigation is under way.

The city plans to stop using the affected software provider. It is also checking backup copies stored on servers across Germany, as the attackers may have been inside the system for several days and could have damaged data or created new vulnerabilities.

Some servers have been brought back online since Tuesday, and the city says suitable backups are available for a controlled restoration. The administration remains able to work only on a limited basis and expects to continue operating in emergency mode next week.