City of Potsdam

Summary

The municipal administration of Potsdam preemptively disconnected its internet connections following indications of a cyberattack, disrupting email communications and severely limiting access to procedural software systems. Critical citizen services—including applications for identity documents, passports, and registration processes—were rendered unavailable, though telephone operations remained functional. Authorities coordinated with regional and security agencies while directing the public to official communication channels for updates on restoration efforts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 29, 2022, the city administration of Potsdam, Brandenburg, proactively disconnected its internet connections following indications of a potential cyberattack. Oberbürgermeister Mike Schubert announced the precautionary shutdown, stating the municipality was acting on security concerns and collaborating with state authorities and security agencies. The immediate consequence was the loss of all email communication capabilities across city administration systems, as both sending and receiving functions became unavailable. This network isolation also caused significant operational disruptions to the city's procedural software platforms, forcing departments to operate with limited digital functionality. Schubert publicly requested patience from residents regarding services handled through civic service facilities, acknowledging the inconvenience caused by the emergency measure.

The incident specifically disrupted citizen-facing services including applications for identity documents such as passports and national ID cards, along with registration services for address changes or new residencies. While telephone systems remained operational, the inability to process digital transactions or communications created bottlenecks in municipal operations. The city administration directed residents to its official website and Twitter account (@lh_potsdam) for status updates on restoration efforts. No technical details regarding the nature of the suspected attack, potential threat actors, or specific compromised systems were disclosed publicly. Restoration timelines remained unspecified as of the initial announcement, with authorities focusing on containment through maintained network isolation while investigative and remediation activities continued in coordination with regional and security partners.

Sources

Sources available to members: 1 source.