Stadt Nürnberg

Summary

The city of Nuremberg experienced a sustained DDoS attack targeting its official website, causing prolonged inaccessibility for residents. Attackers utilized botnets to flood external servers with hundreds of thousands of simultaneous requests per minute, overwhelming infrastructure through distributed sources that continually shifted to new IP addresses. While service was partially restored after mitigation efforts by municipal IT experts and server operators, ongoing attacks from newly deployed systems required persistent defensive measures. Officials confirmed no compromise of internal administrative systems or data theft occurred, characterizing the incident as an attempt to disrupt operations rather than extract information. The city explicitly ruled out ransom payments despite acknowledging potential financial motives behind such attacks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 12, 2023, the City of Nuremberg's official website (nuernberg.de) experienced a sustained distributed denial-of-service (DDoS) attack beginning at approximately 8:30 AM local time. The attack rendered the portal inaccessible to citizens seeking municipal information and services, with attackers flooding external servers through coordinated botnets generating hundreds of thousands of simultaneous requests per minute. City officials confirmed the IT infrastructure of internal administrative systems remained unaffected, with no evidence of data exfiltration or compromise. Technical analysis identified the attack methodology as intentionally overwhelming server capacity rather than attempting to breach security perimeters. Service provider teams and municipal IT experts immediately initiated countermeasures to restore functionality, achieving partial accessibility despite ongoing volatility. By 2:30 PM, the website resumed operations with intermittent stability while defenders continued mitigating recurrent attacks originating from constantly shifting IP addresses and newly activated servers.

The attackers employed dynamically changing infrastructure across multiple geographic origins, complicating attribution and requiring continuous adaptive defenses described by city spokespersons as "Sisyphean work." Municipal authorities publicly ruled out ransom payments to cybercriminals despite acknowledging potential motivations ranging from disruptive sabotage to financial extortion, though no specific monetary demands were received. Service restoration efforts prioritized maintaining public access despite persistent smaller-scale disruptions, with technicians monitoring systems for renewed volumetric attacks. Final confirmation of full mitigation timelines remained unreported, though officials noted servers operated "reasonably stable" following initial containment. The incident exclusively impacted external web services without affecting internal city networks, data repositories, or critical infrastructure systems. No collateral damage to dependent municipal functions or third-party systems was documented in available reports.

Sources

Sources available to members: 1 source.