Cyber Incident Victim: Bau- und Wohnungsgenossenschaft Wien-Süd
Date:
Jul 2022
Location:
Austria
Summary
A cyberattack targeted a Vienna-based housing cooperative, disrupting IT systems through data encryption and potentially compromising customer data. The organization implemented immediate legal and technical measures, collaborating with forensic and cybercrime specialists to restore full functionality while maintaining email and telephone accessibility. Although ongoing projects remained unaffected, the cooperative preemptively notified customers about possible data exposure despite uncertainty regarding actual exfiltration. Core operational databases reportedly escaped compromise, and full system recovery was anticipated within the following week. The incident impacted multiple affiliated entities within the corporate group, including several nonprofit housing societies and management companies.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 8 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 4, 2022, the Gemeinnützige Bau- u. Wohnungsgenossenschaft „Wien-Süd“ eGenmbH and several affiliated companies experienced a disruptive cyberattack that compromised their IT systems. The attackers deployed data encryption techniques, severely restricting operational capabilities across the Vienna-based housing cooperative group. While core operational databases reportedly remained unaffected, the encryption event disrupted normal business functions. Deputy Chairman Walter Koch confirmed the organization immediately initiated legal and technical response protocols, collaborating with forensic and cybercrime specialists on a 24/7 basis to restore systems. The cooperative proactively notified customers about potential unauthorized access to their data, though investigators could not initially confirm whether data exfiltration had occurred. This precautionary transparency measure reflected concerns that attackers might have accessed sensitive information during the breach.
The attack impacted seven entities within the corporate structure, including the primary cooperative and six affiliated housing management and project companies registered under distinct legal entities. Despite system disruptions, critical communication channels like email and telephone remained functional, allowing continued tenant interactions. Ongoing construction and housing projects faced no immediate operational threats due to the isolation of core databases from the attack. Forensic analysis confirmed the containment of the encryption threat, with no residual danger to systems by the time of public disclosure on July 7. Full restoration of all affected IT systems was projected to occur within the following week, though the cooperative maintained its precautionary stance regarding potential data compromise throughout the recovery period.