CSIDB logo
Incident

Reitzner AG

Incident posture

Attack window
Apr 2022
Location
Germany
Status
Historical
CIA posture
Available to members
Updated
2026-01-28 09:03

Linked entities

Victim
Reitzner AG
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Apr 2022
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

A cyberattack targeted Reitzner AG, encrypting its operational systems and partially compromising several customer systems. The company deployed an emergency team to assess affected customers and immediately fulfilled data protection obligations, including notifying clients, reporting to authorities, and filing a police report. The Bavarian State Criminal Police Office's cybercrime unit initiated an investigation, determining the incident was a deliberate attack by skilled threat actors who breached security systems with significant criminal intent. System analysis and data recovery efforts remained ongoing at the time of reporting.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

On April 18, 2022 (Easter Monday), Reitzner AG and Donau-Stadtwerke (DSDL) in Dillingen, Germany, suffered a coordinated cyberattack. The breach against Reitzner AG occurred in the early morning hours, resulting in the complete encryption of their operational systems. A limited number of customer systems connected to Reitzner's infrastructure were also compromised, with some fully or partially encrypted. The company activated its emergency response team immediately to assess all affected customers. Reitzner AG fulfilled all mandatory data protection obligations without delay, including direct notifications to impacted customers, formal reporting of the incident to data protection authorities, and filing a criminal complaint with police.

The Bavarian State Criminal Police Office's Cybercrime Division launched an investigation on the afternoon of Easter Monday, though data analysis remained ongoing at the time of reporting. Investigators confirmed the attack was a targeted intrusion executed by one or more specialized threat actors. These individuals demonstrated significant technical capability and criminal intent, deliberately bypassing Reitzner AG's security systems to gain unauthorized access. No operational disruptions or additional impacts affecting Donau-Stadtwerke were detailed in the available report. The forensic examination continued to determine the full scope of compromised data and attack methodology.

Sources

Sources available to members: 1 source.

CSIDB