CSIDB logo
Incident

Hessischer Apothekerverband

Incident posture

Attack window
Apr 2025
Location
Germany
Status
Unknown
CIA posture
Available to members
Updated
2026-06-19 08:15

Linked entities

Victim
Hessischer Apothekerverband
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Apr 2025
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

The Hessischer Apothekerverband was hit by a large cyberattack that compromised and encrypted security‑relevant parts of its IT systems, also affecting the affiliated GVA and WDA organizations. The association said it has engaged an IT forensics team to investigate the incident and conduct a damage analysis, while noting that no evidence has been found so far that member, seminar or training participant data were exposed. It added that an additional IT expert team is working on system restoration, aided by existing backup concepts, and that the incident has been reported to the data protection authority and police, with support from the Hessian State Criminal Police Office.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

On 27 April 2025 the Hessischer Apothekerverband suffered a cyber attack that was disclosed to its members in a circular issued on 8 May 2025. The attack also affected the affiliated organisations Gesellschaft für Verkaufsförderung in Apotheken und Vermögensverwaltung (GVA) and Wirtschaftsakademie Deutscher Apotheker (WDA). According to the HAV statement the attackers compromised and encrypted security‑relevant parts of the IT systems. The association has engaged an IT‑forensics team to conduct a detailed investigation and to produce a damage analysis. As of the circular no evidence has been found that personal data of members, seminar participants or study attendees were compromised. The full extent of the damage caused by the attackers remains under investigation.

In parallel the HAV has deployed an additional IT‑expert team that has been working continuously to restore the affected systems, citing the effectiveness of existing backup concepts and available backups. The incident has been reported to the competent data‑protection authority and a criminal complaint has been filed with the police. The Hessian State Criminal Police (Landeskriminalamt) is providing advisory and operational support to the association. The HAV continues to monitor the situation and will communicate further findings as the forensic investigation concludes.

Sources

Sources available to members: 1 source.

CSIDB