Landtag Nordrhein-Westfalen

Summary

A cyberattack targeting the North Rhine-Westphalia state parliament was detected after its firewall blocked a connection attempt from within the internal network to a critical IP address range. Investigators from the Cologne Cybercrime Unit traced the activity to an official laptop assigned to a Green Party parliamentary member, leading to the device's seizure by police. In response, the parliament expanded logging of internet traffic and established protocols to share relevant data with authorities upon approval from political factions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around October 1, 2022, the parliament of North Rhine-Westphalia (Landtag NRW) experienced a cybersecurity incident involving unauthorized network activity. Landtag President André Kuper initiated an official investigation, engaging the Cybercrime Central and Contact Point (ZAC) of the Cologne Public Prosecutor's Office. According to a parliamentary spokesperson, internal monitoring systems detected an attempted connection originating from within the Landtag's network to a critical IP address range classified as high-risk. The parliament's firewall successfully blocked this connection attempt, preventing further unauthorized access. The incident prompted immediate operational changes, including heightened scrutiny of internal network traffic and coordination with law enforcement agencies.

Investigators traced the suspicious network activity to a laptop issued as official equipment to a member of the Green Party parliamentary faction, confirming the device was state-provided rather than personal property. Authorities seized the device for forensic examination following standard evidence-handling protocols. In response to the breach, the Landtag expanded its internet traffic logging capabilities across the parliamentary network to enhance future detection capabilities. All parliamentary factions consented to a protocol enabling investigators to access relevant network data records as needed for the ongoing inquiry. No additional technical details regarding the attack vector, data compromise, or threat actor attribution were disclosed in initial reports.

Sources

Sources available to members: 1 source.