Cyber Incident Victim: Landesportal Sachsen-Anhalt
Date:
Aug 2025
Location:
Germany
Summary
Landesportal Sachsen-Anhalt has been repeatedly hit by DDoS attacks that temporarily disrupted access for certain user groups, while the websites of the CDU, AfD and SPD parliamentary groups also experienced temporary outages. Officials said the attacks are suspected to originate from Russia and are linked to the pro‑Russian DDoSia network, prompting a temporary server shutdown and subsequent restoration of the sites in Germany, with officials describing the incidents as a direct threat to democratic processes and political discourse.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In July 2025, several ministry websites in Saxony‑Anhalt were temporarily unavailable due to distributed denial‑of‑service attacks, according to a spokesperson from the Ministry of Infrastructure and Digital Affairs in Magdeburg. The Federal Office for Information Security issued a corresponding notification about the attacks. In mid‑August 2025, the websites of the CDU, AfD, and SPD parliamentary factions in Saxony‑Anhalt were temporarily unreachable. The Landesportal Sachsen‑Anhalt was also repeatedly affected by the same overload attacks. The attacks were described as distributed denial‑of‑service attacks that overload servers with massive requests, rendering them temporarily unreachable.
The CDU parliamentary faction leader Guido Heuer stated that the attacks were suspected to originate from Russia. He said the faction worked together with its IT service provider to shut down the affected server and subsequently restore the website in Germany. The Greens parliamentary faction reported that its website was targeted on 13 August 2025 and that the attack was detected in time with the help of its technical provider, preserving system integrity. The Greens characterized the attack as a warning shot from a pro‑Russian hacking network referred to as DDoSia. The Greens warned that the incident demonstrated the vulnerability of democratic structures in the digital realm.
The Greens stated that the attack constituted a direct assault on political will formation, freedom of opinion, and the integrity of democratic institutions in the state. They emphasized that the political public in Saxony‑Anhalt would not be intimidated or divided by external authoritarian forces. The Ministry spokesperson confirmed that corresponding security measures were implemented after the incidents. After the server was taken offline and brought back online, the affected websites were restored and made reachable again in Germany.