Loading story…
Stadtwerke Landsberg KU, a municipal utility in Landsberg, Germany, reported that a criminal ransomware attack encrypted its central IT systems during the night of 1 September. The utility disconnected internet links, shut down affected systems, activated its crisis plan, and engaged external cybersecurity and IT-forensics specialists to investigate and restore operations.
The company said its critical services—including electricity and water supply, wastewater treatment, district heating, fibre infrastructure, charging stations, swimming-pool operations, and parking—were not affected. It warned that personal data may have been exfiltrated during the intrusion and advised potentially affected customers to watch for phishing and other social-engineering attempts.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Stadtwerke Landsberg KU issued an IT-incident notification, reporting that its critical operational infrastructure was unaffected while warning that personal data may have been exfiltrated. The utility said it notified authorities, filed a criminal complaint, and advised affected individuals to watch for phishing and social-engineering attempts.
During the night of 1 September 2026, Stadtwerke Landsberg KU suffered a criminal ransomware attack that encrypted its central IT systems. The utility disconnected internet connections, shut down systems, activated its crisis plan, and engaged external cybersecurity and IT-forensics specialists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcecyberveille.ch
Open sourcestadtwerke-landsberg.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany’s Dresden State Art Collections (**SKD**) reported a targeted cyberattack that disrupted large parts of its digital infrastructure, leaving online ticketing, visitor services, and the museum shop unavailable and forcing on-site payments to cash-only. The museums remained open, and Saxony’s culture ministry said security systems protecting the collections were not affected; the attacker, motive, and whether a ransom demand was involved were not disclosed, and full restoration timelines were unclear. Separately, multiple German organizations reported **ransomware** incidents causing service outages. The Verkehrsgesellschaft Main-Tauber (**VGMT**) said attackers encrypted its servers and data, forcing closure of its office and mobility center and cutting phone/email availability; it remains unclear whether data was stolen. Regensburg-based IT service provider **Conceptnet** said threat actors gained access around 13 January 2026 and encrypted core systems including web and email servers, disrupting websites for customers (including REWAG, Stadtwerk Regensburg, and SSV Jahn Regensburg) while external forensics and recovery efforts continue and temporary websites have been stood up to maintain limited customer presence online.
Jun 29, 2026
The city administration of Ludwigshafen experienced a significant IT outage, with all online services, telephone, and email communications rendered unavailable for several days. Initial investigations and monitoring system alerts prompted the city to disconnect its IT systems on November 6, and a forensic analysis was immediately launched. Authorities have since confirmed that indications of a cyberattack have strengthened, though there is currently no evidence of citizen data exfiltration. Emergency protocols were activated, and the city continues to assess the extent of the incident while working to restore services. This incident highlights the ongoing threat to public sector organizations in Germany, as noted in recent reports by the Federal Office for Information Security (BSI), which warns that cyberespionage and attacks on public administration remain a serious concern. The BSI also emphasizes that many institutions, particularly those with political relevance, remain vulnerable due to insufficient security measures. The Ludwigshafen case underscores the need for robust cybersecurity and incident response capabilities in municipal administrations.
Jul 12, 2026
Romania's national water management agency, Administrația Națională Apele Române (Romanian Waters), suffered a significant ransomware attack that compromised around 1,000 systems, including servers, workstations, and critical IT infrastructure. The attackers used Microsoft's BitLocker, a legitimate Windows encryption tool, to lock files and left ransom notes demanding negotiations within seven days. Despite the widespread IT disruption, operational technologies such as dams and flood defenses remained unaffected, and hydrotechnical operations continued with staff relying on alternative communication methods like telephone and radio due to email outages. Authorities have not attributed the attack to a known ransomware group and have advised against negotiating with the attackers. The Romanian National Cyber Security Directorate (DNSC) confirmed that the attack impacted ten of the country's eleven river basin management organizations, but emphasized that water infrastructure operations were not disrupted. The use of BitLocker as a "living off the land" technique highlights a trend where attackers leverage built-in system tools to evade detection and complicate incident response. The DNSC reiterated its policy of not engaging with cyber extortionists and urged IT teams to focus on system restoration rather than external communications. The agency continues to investigate the incident and work towards full remediation of affected systems.
Jun 29, 2026