German Bishops' Conference

Summary

On a Monday afternoon, the IT systems of the German Bishops' Conference secretariat were hit by a professional cyberattack attributed to an organized cybercrime group. Emergency plans were activated immediately, the IT infrastructure was disconnected from the internet, and external IT forensics specialists were engaged alongside law enforcement and the data protection officer to investigate how the attackers bypassed the multi-layered security systems. Email communications remain limited due to the ongoing investigation and network isolation, and authorities are also examining whether the threat actors successfully exfiltrated data from the compromised environment. Affected individuals will be notified in accordance with applicable data protection regulations if personal data is confirmed to be impacted.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 10 February 2025, the IT systems of the Secretariat of the German Bishops' Conference (Deutsche Bischofskonferenz), which also serves as the office of the Association of Dioceses in Germany (Verband der Diözesen Deutschlands), fell victim to a professional cyberattack. A group attributed to organized cybercrime publicly claimed responsibility for the intrusion. The attack was detected late on Monday afternoon, at which point the pre-established emergency plans were immediately activated. As an immediate containment measure, the IT systems were disconnected from the internet to prevent further unauthorized access. Simultaneously, the responsible investigative authorities and the data protection commissioner were notified of the incident. External IT forensics specialists were brought in to investigate how the attackers had managed to circumvent the multi-layered IT security systems in place.

In the immediate aftermath of the detection and disconnection, the organization's email reachability was significantly restricted due to the ongoing investigation and the deliberate separation of the IT infrastructure from the network. Forensic specialists are actively examining whether the threat actors succeeded in exfiltrating data from the compromised IT systems. The organization stated that if personal data is found to be affected by the IT security incident, the Association of Dioceses in Germany will proactively inform all affected individuals in accordance with applicable data protection regulations. The incident was publicly disclosed by the German Bishops' Conference through an official press release issued on the same day as the attack.

Sources

Sources available to members: 1 source.