Cyber Incident Victim: Kaufbeuren
Date:
Jun 2023
Location:
Germany
Summary
The city of Kaufbeuren fell victim to a cyberattack when its official Instagram account was hacked. Attackers gained access, likely by tricking a marketing department employee into updating terms of service, and subsequently issued a ransom demand which the city refused to pay. As a result, the city lost all access to the account and it became unsearchable for other users. Officials were working with Meta, Instagram's parent company, to resolve the issue and restore access.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around June 1, 2023, the city of Kaufbeuren in Bavaria, Germany, publicly disclosed that it had fallen victim to a cyberattack targeting its official Instagram account. The incident was formally announced by Mayor Stefan Bosse during a meeting of the city's administrative committee on the evening of Tuesday, May 30th. The initial public notification, however, had occurred days earlier when the city administration used its Facebook page to inform the public about the compromise on Friday, May 26th. The attack resulted in the city losing all access to its Instagram account. Furthermore, the account was made unfindable and inaccessible to the platform's general user base, indicating it was either deactivated, deleted, or made private by the attackers.
The primary motive behind the attack was financial gain. Mayor Bosse explicitly stated that the perpetrators had issued a demand for money. The city's official response was one of firm refusal to comply with this extortion attempt. Bosse declared, "There is a demand for money, which we will not comply with," establishing a clear non-negotiation stance with the criminals responsible for the breach. The specific amount of money demanded was not disclosed in public statements.
The initial attack vector was identified as a social engineering scheme targeting a city employee. According to the information provided by Mayor Bosse, an employee within the city's Department of Tourism and Marketing received a communication that appeared to instruct her to update the account's terms of use. This deceptive request, which masqueraded as a legitimate administrative requirement, was the mechanism through which the attackers successfully gained control of the credentials for the city's Instagram account. The precise nature of this communication—whether it was a phishing email, a direct message on the platform, or another form of contact—was not detailed in the public reports.
Upon gaining access, the attackers assumed control of the account, effectively locking out the legitimate owners. The impact was immediate: the city's official channel for tourism promotion and public communication on the Instagram platform was completely severed. The account's disappearance from search results and user feeds meant that all previously published content was no longer publicly visible, and the city lost the ability to publish new information or engage with its audience through this medium. This represented a significant disruption to the city's marketing and public outreach operations, which relied on social media to engage with citizens and visitors.
The city's response involved immediate efforts to regain control and restore the account. The primary course of action was to work directly with Meta Platforms, Inc., the parent company that owns and operates Instagram. The city administration engaged with Meta's support and security teams to report the account takeover and initiate the official process for account recovery. This process typically involves verifying the rightful ownership of the account through official channels and documents, a procedure that can take time to complete. A city representative provided a public assessment that the Instagram account would likely be usable again within a matter of a few days, indicating confidence in the recovery process underway with Meta.
The incident was significant enough to be raised and discussed at the highest levels of the city's administration. During the administrative committee meeting, Mayor Oliver Schill directly addressed the event, seeking details on what had transpired and inquiring about the city's response plan to the cyberattack. This demonstrates that the breach was treated with seriousness and was considered a matter of official concern beyond just the marketing department, warranting attention from city leadership. The public disclosure via the committee meeting and the earlier Facebook post reflects a strategy of transparency regarding the security incident.
The consequences of the attack were primarily operational and reputational. Operationally, the city's tourism and marketing department was unable to conduct its normal social media activities on Instagram for a period of several days. The loss of this communication channel potentially impacted promotional campaigns and citizen engagement. Reputationally, the event highlighted the vulnerability of public institutions to cyber threats and served as a public example of a successful social engineering attack. However, by publicly refusing to pay the ransom, the city administration aimed to project a stance of resilience against criminal extortion attempts.
The technical scope of the incident appeared to be contained to the single Instagram account. There were no public indications from city officials that other systems, networks, or digital assets within the Kaufbeuren municipal government were compromised. The attack was characterized specifically as a takeover of a social media account, not a broader network intrusion. The restoration of the account hinged entirely on the procedures and timelines enforced by the external platform provider, Meta, rather than on internal technical actions by the city's IT staff. The resolution was dependent on the effectiveness of the third-party's account recovery protocols.