Association of German Chambers of Industry and Commerce

Summary

The Association of German Chambers of Industry and Commerce suffered a massive cyberattack, prompting a precautionary shutdown of all IT systems, digital services, telephones, and email servers to contain the incident and allow defenses to be strengthened. The attack disrupted operations across multiple regional divisions, affecting over three million member businesses; partial service restoration occurred after safety checks, though full recovery timelines remained unclear. While unconfirmed, the incident exhibited characteristics consistent with ransomware, though no threat actor had claimed responsibility at the time of reporting.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 3, 2022, the Association of German Chambers of Industry and Commerce (DIHK) experienced a large-scale cyberattack, prompting an immediate shutdown of all IT systems, digital services, telephones, and email servers. DIHK, representing 79 regional chambers and over three million businesses across Germany, took these measures as a precautionary step to contain the incident and allow IT teams to analyze the attack and reinforce defenses. General Manager Michael Bergmann confirmed the attack’s occurrence on Wednesday via a LinkedIn post, describing it as "massive" but providing no specifics on the intrusion method or attacker identity. The organization’s core functions—including legal representation, foreign trade support, training programs, and regional economic development services—were disrupted nationwide. Restoration efforts began cautiously, with some services gradually reactivated only after rigorous safety checks, though full functionality remained unavailable at the time of reporting.

The attack impacted multiple regional chambers without apparent geographic focus, with divisions in North Rhine-Westphalia, Lower Saxony, Bavaria, and Mecklenburg-Western Pomerania all confirming operational disruptions. For instance, the Cologne Chamber of Industry and Commerce reported severely limited telephone connectivity and a completely offline website. While the incident exhibited characteristics consistent with ransomware, such as the proactive system shutdowns to hinder malware propagation, no ransomware group had claimed responsibility on major extortion platforms by August 4. DIHK refrained from confirming any data compromise or encryption, and Bergmann noted the inability to estimate how long emergency measures would remain in place. The organization prioritized securing systems over rapid service restoration, maintaining public updates through its website and Bergmann’s social media while withholding technical details about the attack vector or potential perpetrators.

Sources

Sources available to members: 1 source.