Cyber Incident Victim: Bavarian State Government
Date:
Feb 2025
Location:
Germany
Summary
The Bavarian government experienced a distributed denial-of-service (DDoS) attack attributed to suspected pro-Russian hacktivist actors, temporarily disrupting access to its state chancellery, digital ministry, police website, and several municipal portals. While the attack caused service interruptions, no data compromise, encryption, or permanent damage occurred. Authorities confirmed the incident's technical containment and transferred the case to law enforcement for criminal investigation, though no definitive link to concurrent security events was established.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 13, 2025, the Bavarian State Government experienced a cyberattack targeting its digital infrastructure. The incident specifically affected the State Chancellery and the State Ministry for Digital Affairs, with attackers disrupting access to their public-facing websites. Investigators from the Bavarian State Office for Security in Informationstechnik (LSI) attributed the attack with high probability to "pro-Russian hacktivism," though no specific threat actor was named. The attackers employed a Distributed Denial-of-Service (DDoS) technique, overwhelming servers with traffic to render websites temporarily inaccessible. No data exfiltration, encryption, or permanent damage occurred during the breach. Service interruptions lasted approximately one day for primary government portals, with full functionality restored after mitigation efforts. Concurrently, irregularities were observed on the Bavarian Police's website, though the LKA did not confirm a direct connection to the main incident. Secondary disruptions also impacted the Munich District Office and the city of Garching's websites for similar durations.
The LSI assumed investigative responsibility upon detection, conducting technical analyses to confirm the attack vector and scope. Following evidence collection, authorities transferred the case to regular police channels for criminal prosecution on February 16. The State Criminal Police Office (LKA) acknowledged open investigations but declined to speculate on potential links to the contemporaneous Munich Security Conference. All affected entities resumed normal operations without reporting residual vulnerabilities or compromised systems. Public statements emphasized no evidence of data loss or persistent network infiltration beyond the temporary service denials. No further attribution details or geopolitical motivations were disclosed beyond the initial pro-Russian hacktivism assessment.