Hackers likely copied most of Eichstätt’s city data

Hackers appear to have copied a large share of the City of Eichstätt’s data in a weekend cyberattack, Bavarian broadcaster BR reported. The town hall and its branch offices are closed until further notice, and local servers have been taken offline.

The attack was discovered on Monday morning after staff reported IT problems. The city’s IT department detected an external intrusion and disconnected its local servers as a precaution. Bavaria’s Central Office for Cybercrime and the State Criminal Police Office are investigating.

Investigators suspect a ransomware attack, in which malicious software blocks computer systems or encrypts data and attackers demand payment to restore access. The city has not received a ransom demand. It said its data backups had worked and that, based on current information, the data could be restored.

It remains unclear who carried out the attack, how they gained access and exactly which data was taken. The city has urged people to be cautious of messages or invoices claiming to come from the administration. Its emergency phone hotline will remain open on Wednesday, when the city also plans to provide details of how its offices can be contacted.

Cybercrime investigators say ransomware cases can be difficult to solve because they involve large numbers of digital traces, often extending abroad.