Donau 3 FM

Summary

A radio station experienced a disruptive cyberattack involving a ransom demand, causing immediate system-wide failures that disabled computers, locked files, and temporarily halted all broadcasting channels before emergency backups activated. IT specialists were rapidly engaged, the network was isolated, and authorities were notified, while operations shifted to analog equipment—including microphones, a backup studio mixer, and CDs—to sustain broadcasts. Staff improvised content via mobile devices for social media and WhatsApp interactions, fulfilling listener music requests through live acoustic performances, borrowed instruments, and personal record collections, maintaining uninterrupted programming with minimal resources.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 17, 2024, DONAU 3 FM experienced a disruptive cyber incident beginning shortly after 3:00 PM when multiple workstation screens flickered and displayed a ransom demand text window. All computers immediately became inoperable, with locked files and temporarily silenced broadcast channels until emergency backup systems activated. The station swiftly engaged IT specialists within minutes, completely disconnected its systems from the network, and notified both the State Data Protection Commissioner and criminal police. Technical assessments revealed only legacy equipment remained functional: microphones connected to an analog mixing console in the backup studio and a CD player. Staff located an emergency case containing CDs dating back to the station's 2003 founding era, enabling continued operations through rudimentary means.

The station maintained broadcasts using these analog resources while managing social media and WhatsApp communications via mobile devices. Moderator Marcus Oesterle announced the situation on air, prompting listener music requests through WhatsApp. When requested tracks weren't available on CD, staff members Peter Miller and Roland Eberhardt—both practicing musicians—performed live acoustic versions using a guitar donated by a local music store. Morning show host and program director Andi Scheiter introduced his personal DJ equipment the following day for request shows, while Eberhardt contributed a turntable and record collection. The improvised broadcasts featured real-time fulfillment of listener requests through combined use of archival CDs, live musical performances, and vinyl records, effectively reverting to pre-digital broadcasting methods. All standard computer systems remained offline throughout the incident with no restoration timeline indicated in available reports.

Sources

Sources available to members: 1 source.