Cyber Incident Victim: Enercon
Date:
Oct 2023
Location:
Germany
Summary
Multiple German municipalities, including Dortmund and Köln, experienced distributed denial-of-service (DDoS) attacks targeting their public web servers, causing temporary outages. The attacks involved botnets flooding servers with tens of thousands of requests per second from constantly changing IP addresses, overwhelming infrastructure and rendering official websites inaccessible. While Dortmund's site remained down due to sustained malicious traffic, Köln partially restored access through initial countermeasures. Internal administrative systems and sensitive data were unaffected in confirmed cases. The incidents formed part of a broader pattern affecting several urban centers, with mitigation efforts ongoing through collaboration between hosting providers and cybersecurity experts at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 12, 2023, multiple German cities, including Dortmund and Cologne, experienced distributed denial-of-service (DDoS) cyberattacks targeting their public web servers. The incident began around 8:30 AM when Dortmund's municipal homepage became inaccessible due to overwhelming traffic volumes. Attackers utilized botnets to flood dortmund.de with tens of thousands of requests per second from constantly changing IP addresses, deliberately overloading the server's capacity. Cologne's systems simultaneously faced similar malicious traffic patterns, characterized by coordinated attempts to disrupt service availability through artificially inflated request volumes. Municipal authorities confirmed the attacks constituted intentional overload attempts rather than data breaches, with no evidence of compromised internal networks or administrative IT systems. Both cities emphasized that sensitive data remained unaffected despite the sustained bombardment targeting public-facing web infrastructure.
Dortmund's hosting provider collaborated with external cybersecurity experts to implement countermeasures against the ongoing attack, which remained active at the time of reporting. Cologne's IT teams successfully restored partial functionality to their homepage through initial defensive actions, though the attack against their servers continued. Municipal communications described the incidents as part of a broader pattern affecting urban centers nationwide, with Nuremberg, Dresden, and Hanover reporting comparable DDoS disruptions on the same date. The coordinated nature of these geographically dispersed attacks suggested a synchronized targeting methodology focused on crippling municipal web services. Technical responses prioritized traffic filtering and infrastructure resilience while authorities monitored for extended impacts on citizen-facing digital services.