Germany Archives - ICSSTRIVE

Ransomware Attack at German Utility, Stadtwerke Landsberg

September 1, 2026

German utility, Stadtwerke Landsberg KU, suffered a cyberattack September 1, resulting in the encryption of key IT systems.
Stadtwerke Landsberg KU is a public municipal utility company owned by the city of Landsberg am Lech, Germany, that provides essential local services like power, water, and public infrastructure.
“First and foremost: operations regarding the electricity grid, water supply, wastewater treatment plant, district heating, fiber-optic network, charging infrastructure, the “Inselbad” pool complex, and parking garages have not been affected by the attack,” the company said in an advisory. “However, the utility’s staff are currently available by phone and email only to a limited extent.”

Cyberattack Disrupts Bär Cargolift Production and IT Systems in Germany

November 28, 2025

A cyberattack struck Bär Cargolift (Gerd Bär GmbH) on Friday, 28 November 2025, affecting its IT systems. The company publicly acknowledged the attack on its website. Normal operations were disrupted while containment and remediation took place. Production resumed during the week after the attack according to company updates. Orders for cargolifts and spare parts could still be placed once the company restored email and web shop functionality. Email systems were taken offline during the incident. By the first week of December, email services and production were reported as restored or resuming. Investigation is ongoing.

Cyberattack Disrupts Refresco Production Systems in Germany

September 24, 2025

Refresco, a global beverage manufacturer, suffered a cyberattack. The incident affected production systems and the inflow and outflow of goods in Germany. Some manufacturing lines and logistics workflows were halted or slowed while systems were investigated and restored. Refresco responded by accepting customer orders via email while recovery of core systems was underway, indicating that automated order processing and production planning were affected. At time of reporting systems recovery is in progress, operational mitigation in place.

Refresco has a large global footprint (over 75 manufacturing sites and thousands of employees), making even localized production disruptions potentially significant for supply chains.

Cyberattack Forces Temporary Production Disruption at Heim & Haus

June 24, 2025

Heim & Haus, one of Germany’s largest producers and direct sellers of building components, suffered a ransomware attack. The attackers gained unauthorized access to IT systems and encrypted data. The encrypted IT systems were taken offline immediately. Corporate networks, email, customer portals, and internal services were inaccessible for days. Production systems were restored and returned to full operational capacity by early July 2025, with communications channels (phone, email) reactivated soon after. A July 10 update stated core systems (customer portal, direct sales, assembly scheduling) were back online, though processing delays or restricted access could still occur for some services.

Reports indicate about 48 GB of internal information was exfiltrated and posted as proof by the ransomware group Kawa4096.

Siloking Manufacturing Stopped by Ransomware

June 15, 2025

Siloking Mayer Maschinenbau GmbH, a German agricultural machinery manufacturer, was hit by a cyberattack. The attack involved ransomware that encrypted IT systems and caused operational disruption across the company’s network. Production continued only in emergency mode after 5 days while systems were restored.

Wellteam Packaging Production Stops After Cyber Incident

May 23, 2025

Wellteam, a German packaging manufacturing company, was hit by a significant cyberattack. The attack affected internal communications, halted machinery and transport systems, and forced the company to send employees home due to the inability to continue production. Production was brought to a standstill at all three Wellteam locations.

800 GB Databreach at German Manufacturer Stürmer Maschinen

February 25, 2025

The wholesaler Stürmer Maschinen became the target of a ransomware attack. The ransomware gang Lynx claim to have subtracted a data set of 800 gigabytes. It is unclear exactly which data it is. There is no information on the ransom claim and deadline. Stürmer Maschinen has not yet officially commented on the incident.

German Napkin Maker Insolvent after Ransomware Attack

May 19, 2025

German paper napkin manufacturer, Fasana, is now facing insolvency after a ransomware attack this past May disrupted all forms of operations at the company.
In a bit of irony, on May 19, Fasana’s entire printing infrastructure suddenly began producing ransom notes. In the attack, it appeared every laptop and desktop PCs ended up locked down. The next day, May 20, the company was unable to process orders worth over €250,000 ($287,467).
For nearly two weeks, Fasana was unable to: Print delivery notes or invoices, fulfill customer orders and process employee salaries.
In that short timeframe, the company suffered financial losses of over €2 million ($2.3 million). Dr. Dirk Wegener, the court-appointed insolvency administrator, said the company could not conduct basic business operations.

Ransomware Disrupts Collins Aerospace Systems, Causing Major Flight Delays Across Europe

September 19, 2025

A cyberattack disrupted the MUSE (Multi‑User System Environment) check‑in, boarding and baggage handling software operated by Collins Aerospace — a major aviation systems provider and aerospace subsidiary of RTX Corporation. This incident impacted multiple large airports across Europe. Systems affected were automated electronic check‑in desks; boarding pass printing and baggage drop systems; shared passenger processing kiosks.

London Heathrow Airport (UK) reported long delays and manual operations. Brussels Airport (Belgium) reported cancellations and many delayed flights some days saw airlines cancel ~50 % of scheduled departures. Berlin Brandenburg Airport (Germany) experienced check‑in and boarding disruptions, long wait times. Dublin and Cork Airports (Ireland) experienced moderate to minor impacts on check‑in and boarding. Other European airports with MUSE dependency also reported delays.

IT Systems Affected at German Smelter Nickelhütte Aue

October 18, 2025

Nickelhütte Aue has fallen victim to a cyberattack. The attack partially paralyzed its office IT systems by encrypting data. The company explicitly stated that their production IT was not affected, and production continued throughout the incident. A banner appeared on the company website informing visitors that “The company’s IT seems to be down, as the company is currently only reachable by phone. The IT department is currently working with external IT security experts to determine the cause and impact.”

The company is in close contact with the relevant authorities and is cooperating transparently with all relevant parties, it says. It is unclear how long it will take to resolve the problem.

« Older Entries