Landratsamt Odenwaldkreis

Summary

A phishing attack compromised approximately 40 mail accounts at the Odenwaldkreis district administration after employees entered their credentials on a deceptive fraudulent website. Attackers gained access to multiple employee accounts and used them to send further phishing emails aimed at harvesting personal and company data from recipients. In response, the IT department immediately locked the affected accounts and took the corresponding computers offline to limit the damage. The incident was confined to mail accounts, with no attack on the broader IT infrastructure, and no sensitive citizen data was confirmed to have been exfiltrated, though monitoring continues. Authorities stated it is part of a wider phishing campaign and are coordinating with the state's Cyber Competence Center while continuing to assess the full scope.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 10 July 2025, the Landratsamt Odenwaldkreis, a district administration in the German state of Hesse, publicly disclosed that it had fallen victim to a phishing attack the same day. According to the official press release issued by the authority, attackers succeeded in gaining access to multiple employee mail accounts after staff members entered their login credentials on a fraudulent webpage that closely mimicked a legitimate login portal. Once these credentials were harvested, the threat actors were able to log into the compromised accounts and use them to send further phishing emails. The authority stated clearly that the incident was not an attack on the entire IT infrastructure of the administration, but rather a targeted credential phishing operation affecting a specific set of user accounts.

Following the discovery of the breach, the Landratsamt issued an urgent public warning directed at any individuals or organisations who might receive emails appearing to originate from staff members of the office. The administration emphasised that such messages were not genuine communications from its employees, but rather fraudulent emails designed with the intent of harvesting personal or company-related data from the recipients. The warning applied both to messages sent from the compromised internal accounts and served as a general reminder about phishing tactics aimed at external parties.

In response to the incident, the IT department of the Landratsamt immediately initiated containment measures. These included locking the compromised accounts and taking the corresponding workstations offline in order to limit any further unauthorised access. The department began a detailed review of approximately 40 employee mail accounts to determine the precise scope of the attack and to identify all affected users. The authority reported that, based on the information available at the time, no sensitive data belonging to citizens had been exfiltrated. Nevertheless, the administration stated that ongoing monitoring would continue to verify this assessment.

The Landratsamt also confirmed that it was coordinating with the Cyber Competence Center housed within the Hessian Ministry of the Interior (Hessisches Innenministerium), the state body responsible for cybersecurity matters. The authority characterised the attack as part of a broader phishing campaign currently affecting multiple targets, indicating that the incident was not isolated. At the moment of the press release, additional technical details regarding the attack vector, the specific phishing infrastructure used, or the timeline of credential entry could not yet be shared with the public. The administration committed to providing timely updates as further developments emerged and the internal investigation progressed. Alongside the official response, the Landratsamt reiterated general security guidance, advising recipients of suspicious emails purporting to come from its staff to carefully verify sender addresses and embedded links, to refrain from opening attachments when in doubt, and to avoid providing any personal or confidential information. Suspect messages were to be deleted immediately.

Sources

Sources available to members: 1 source.