Loading story…
Deutsche Bahn reported a cyberattack that disrupted its passenger information and ticketing services, temporarily impacting travelers’ ability to access timetable information and book tickets. The outage affected both the DB Navigator mobile app and the bahn.de website, with service instability occurring in multiple waves before systems were brought back to a largely stable state with some temporary limitations.
Deutsche Bahn said its defensive measures helped limit customer impact and that it was coordinating with federal authorities, but it did not attribute the attack or provide details on any perpetrator contact. Reporting identified the incident as a distributed denial-of-service (DDoS) attack that knocked the booking and timetable systems offline for hours; the company also did not confirm whether any customer data was compromised.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
By around 13:00 UTC on 2026-02-18, Deutsche Bahn had restored its website and key booking and timetable systems, though some temporary limitations remained. The company later said systems had been largely stable since the evening and that operations had fully recovered.
After IT problems emerged on Tuesday afternoon and recurred on Wednesday morning, Deutsche Bahn said its experts were analyzing the cause and working to resolve the incident. The company stated that defensive countermeasures were in place to reduce the impact on customers and that it was in contact with federal authorities.
A large-scale distributed denial-of-service attack started on Deutsche Bahn's systems on 2026-02-17 at about 15:45 UTC, disrupting bahn.de and the DB Navigator app. The attack came in waves and affected booking, timetable, and passenger information services for several hours.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcecsoonline.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany’s Dresden State Art Collections (**SKD**) reported a targeted cyberattack that disrupted large parts of its digital infrastructure, leaving online ticketing, visitor services, and the museum shop unavailable and forcing on-site payments to cash-only. The museums remained open, and Saxony’s culture ministry said security systems protecting the collections were not affected; the attacker, motive, and whether a ransom demand was involved were not disclosed, and full restoration timelines were unclear. Separately, multiple German organizations reported **ransomware** incidents causing service outages. The Verkehrsgesellschaft Main-Tauber (**VGMT**) said attackers encrypted its servers and data, forcing closure of its office and mobility center and cutting phone/email availability; it remains unclear whether data was stolen. Regensburg-based IT service provider **Conceptnet** said threat actors gained access around 13 January 2026 and encrypted core systems including web and email servers, disrupting websites for customers (including REWAG, Stadtwerk Regensburg, and SSV Jahn Regensburg) while external forensics and recovery efforts continue and temporary websites have been stood up to maintain limited customer presence online.
Jun 29, 2026
A large-scale **distributed denial-of-service (DDoS)** attack disrupted Norway’s shared government digital infrastructure by targeting systems operated for the Norwegian Digitalization Agency (**Digdir**) by its IT partner **Vivicta**. The attack began early Monday and continued for about 30 hours at varying intensity, knocking multiple public services offline or degrading performance with failed connections, slow responses, and long login times. Authorities said around 10 services were affected, including **ID-porten**, Norway’s key digital identity gateway, as well as **eSignering**, with downstream disruption reported for platforms such as **Altinn** and **Skatteetaten**. The outage also caused knock-on effects in parts of Norway’s health infrastructure, including online pharmacies and the electronic prescription system. Digdir said several services were fully unavailable for short periods and some remained partially inaccessible after stabilization efforts. Norwegian authorities, including the National Security Authority and Data Protection Authority, were notified, and officials said there was **no indication of unauthorized access, security breach, or compromise of personal data**. Digdir described the incident as significantly larger than recent attacks and said it was the third DDoS campaign to hit the agency in recent months.
Aug 28, 2026
Nihon Kotsu, Japan’s largest taxi operator, said unauthorized external access involving malware compromised parts of its internal environment, forcing the company to disconnect affected systems and suspend several services. The disruption hit taxi dispatch, telephone-based bookings, online hire-car reservations, reservation management, web booking, and some internal systems, leaving customers to rely on the **GO** taxi app, nearby taxi stands, or street hailing while restoration work continues. The company said it has isolated parts of its network and brought in external cybersecurity specialists to investigate the cause, scope, and possible impact of the intrusion. Nihon Kotsu has not confirmed any data leak and said it is still assessing whether customer or partner information was exposed, with notifications to follow if necessary; it also warned customers to be alert for suspicious messages or links impersonating the company.
Jul 20, 2026