Verband medizinischer Fachberufe e.V.

Summary

A phishing attack compromised at least three email accounts within the medical professional association, granting attackers unauthorized access to contact information, email contents, and sensitive categories of personal data such as trade union membership and political opinions. One compromised account was used to distribute additional phishing emails, and a subsequent fraudulent incident involving a forged employee signature indicated further data exfiltration, elevating the assessed risk to high for affected individuals. In response, the organization immediately blocked and reset the affected credentials, deleted and reestablished the impacted accounts, engaged IT security and data protection specialists, conducted security audits, and began planning the rollout of multi-factor authentication.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 10 July 2025, the Verband medizinischer Fachberufe e.V. became aware of an incident in which attackers had gained unauthorized access to e-mail accounts within the organisation. The initial point of compromise was identified as a phishing attack, which enabled the threat actors to access at least three e-mail accounts belonging to the association. Once inside these accounts, the attackers were able to view and interact with the personal data and contact information contained within the mailboxes. One of the compromised accounts was subsequently abused to send further phishing messages, amplifying the reach of the original attack and creating a secondary propagation vector beyond the organisation's own infrastructure. At the time of the first assessment, there were no concrete indications that the contents of the affected mailboxes had been exfiltrated, which initially led the association to classify the risk to the rights and freedoms of affected individuals as moderate on the basis of its internal risk analysis. In line with this initial risk classification, the association focused its first round of communication on the persons who were directly impacted by the compromise of the three identified accounts.

The situation evolved on 18 July 2025, when a separate incident came to light that materially changed the risk picture. A fraud attempt was discovered that involved the use of a forged signature belonging to one of the affected employees, indicating that information drawn from the compromised mailboxes had likely been misused outside the organisation. This development was treated as an indication that further data beyond what had originally been assumed may have been exfiltrated from the affected e-mail accounts. As a direct consequence, the association revised its risk assessment upward and determined that the risk to the rights and freedoms of affected individuals was now to be classified as high. The categories of personal data identified as potentially compromised include e-mail addresses of association members, employees, and business partners, as well as names and contact information to the extent that such details appeared in e-mail correspondence. The contents of e-mail communications, including the text of messages and any attachments exchanged, fell into the same scope of potential compromise. The association further noted that special categories of personal data within the meaning of Article 9 of the GDPR were likely affected as well, in particular data relating to trade union membership, and possibly data relating to political opinions and other particularly sensitive information held within the compromised mailboxes.

The data protection notice issued by the Verband medizinischer Fachberufe e.V. outlined the range of risks to which affected individuals could now be exposed. These included the possibility of identity theft and further phishing attempts conducted as follow-on attacks, as well as fraud and deception schemes, such as e-mails sent under the name of the association or related organisations. The association further identified the loss of control over one's own personal data, including the potential dissemination of such data on the darknet, as a concrete risk, and noted that affected persons could in individual cases face exposure of particularly sensitive information such as their trade union membership or political views. Financial damage and reputational harm through the misuse of the compromised data were also listed as potential consequences for affected individuals.

In response to the incident, the association initiated a series of immediate technical and organisational measures. The affected access credentials were blocked and reset without delay, and the compromised accounts were fully deleted and re-established from scratch. External IT security providers and the association's data protection officer were brought in to support the response effort, and comprehensive security audits as well as virus scans were carried out across the affected systems. These scans did not identify any persisting malicious software. The IT service provider additionally reviewed further accounts for indicators of compromise and implemented protective measures. Directly affected contact persons were proactively informed of the incident at an early stage. The association also reported that it was in the process of planning and accelerating the rollout of further technical safeguards, with the introduction of multi-factor authentication highlighted as a key element of this work. Affected individuals were informed of their rights under the GDPR, including the right of access, the right to rectification or erasure, the right to restriction of processing, and the right to object, and were given contact details for the association, its data protection officer, and the competent supervisory authority, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Sources

Sources available to members: 1 source.