Cyber Incident Victim: Ayuntamiento de Badajoz
Date:
Apr 2025
Location:
Spain
Summary
The Ayuntamiento deBadajoz experienced a ransomware attack that shut down its computers and internal network. Servers were powered down following security protocols, rendering the electronic headquarters and registry inaccessible, and administrative deadlines were suspended while IT staff worked to restore the system. Officials convened a meeting of department heads to communicate the situation and coordinate the response.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Wednesday, April 30, 2025, at 09:59, the computers of the Ayuntamiento de Badajoz were reported as not turning on, preventing officials from activating them. The Ayuntamiento stated that the issue originated after its internal network was affected by a ransomware-type computer virus. Ransomware is a malware that blocks access to files on infected devices or systems, typically by encrypting data and demanding a ransom for their release. The incident affected both the Ayuntamiento's own network and the autonomous organisms linked to it. As a result, the Servicios Informáticos del Consistorio pacense began working on system recovery immediately after the problem was detected. The Ayuntamiento decreed a suspension of general administrative deadlines until the system is restored and normal operations resume. Since the morning of the incident, the Ayuntamiento has been informing the affected services about the situation. The Electronic Headquarters and the registry were not operational, and the servers were shut down following security protocols and specialist recommendations to prevent data leakage.
The Ayuntamiento communicated that the incident would be reported to the competent authorities and that information would be updated as the recovery process advances, noting that work had begun from the first moment. Mayor Ignacio Gragera convened a meeting of service heads at 10:00 a.m. to explain the situation. On Tuesday, the day after the initial blackout, employees were able to work normally during the morning, but those who arrived in the afternoon could not continue working. On Wednesday morning, workers found that the computers still did not function. Some municipal employees reported that the servers had gone down at noon on Tuesday and that the IT services had not yet managed to reactivate them. The Ayuntamiento conveyed a message of tranquility and prudence to the citizenry regarding the incident.