Cyber Threat Actor: Bauhaus Hackers

The Bauhaus Hackers are a threat actor known by that alias and have been associated with operations originating from Denmark. Public reporting identifies them as the group responsible for a cyber incident that targeted a home construction goods retailer in mid‑2022. No additional aliases or geographic details beyond the Danish connection have been disclosed in open sources. The actor’s activity to date has been limited to a single publicly documented attack, which provides the basis for any observable characteristics. No state sponsorship, criminal consortium ties, or broader affiliations have been confirmed in the available information.

On June 22 2021 the Bauhaus Hackers carried out a weekend cyberattack against the IT infrastructure of a home construction goods retailer, leaving physical stores open while disrupting digital services. The intrusion caused the retailer’s webshop to experience extended delivery times and led to inaccurate inventory displays across both online and physical warehouse systems. Click & Collect functionality was suspended as a direct result of the disruption, forcing customers to rely on in‑store purchases only. Customer support channels saw a surge in call volume, with email systems becoming non‑functional and agents limited to phone assistance due to restricted access to internal tools. Store employees continued to conduct sales and manage inventory manually, maintaining in‑store operations despite the technical challenges. Recovery efforts were described as ongoing, with the retailer advising customers to monitor its website for updates on service restoration. The incident illustrates the actor’s ability to impair e‑commerce and supply‑chain visibility while leaving brick‑and‑mortar retail functions operational.