CSIDB logo
Incident

Energy Hamburg Radio

Incident posture

Attack window
May 2021
Location
Germany
Status
Historical
CIA posture
Available to members
Updated
2025-10-24 00:00

Linked entities

Victim
Energy Hamburg Radio
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
May 2021
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

Hackers targeted a Hamburg-based radio station, disrupting critical IT infrastructure and forcing a switch to a national program broadcast across FM, DAB+, and webcast platforms while local programming remained offline. The attack encrypted data and compromised servers and workstations, prompting an investigation by regional law enforcement. The duration of service restoration for local operations was undetermined at the time of reporting.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

On the evening of May 11, 2021, hackers executed a cyberattack against ENERGY Hamburg Radio, disrupting critical IT infrastructure and forcing operational systems offline. The attack rendered essential broadcasting components inoperable, compelling the station to substitute its local Hamburg programming with its national ENERGY feed across multiple platforms. Affected distribution channels included the Hamburg FM frequency (97.1 MHz), the local DAB+ digital radio multiplex, and web-based streaming services. Technical systems compromised during the incident encompassed servers and PC workstations, with attackers deploying encryption against data stored on these devices. This disruption immediately eliminated the station’s capacity to produce or transmit localized content from its Hamburg operations.

The Hamburg State Criminal Police Office initiated an investigation following the attack, though no attribution details or specific attacker methodologies were disclosed publicly. ENERGY Hamburg’s announcement confirmed the attack’s paralyzing effect on IT operations but did not specify whether data exfiltration occurred alongside encryption. Service restoration timelines remained undetermined at the time of reporting, leaving listeners without local programming indefinitely. No ransomware group or financial demands were referenced in available communications. The station directed audiences to energy.de for updates while maintaining national programming as a contingency measure during the outage.

Sources

Sources available to members: 1 source.

CSIDB