Cyber Incident Victim: RWE
Date:
Sep 2018
Location:
Germany
Summary
A German energy company faced distributed denial-of-service (DDoS) attacks targeting its public website, causing prolonged accessibility issues. The incident occurred amid heightened tensions over the firm's controversial coal mining expansion plans near Hambach Forest, where activists had established protest camps and clashed with authorities during eviction efforts. A video attributed to a hacker collective using Anonymous branding claimed responsibility, threatening further cyber attacks and economic harm unless forest clearing ceased immediately. Police were notified, but no additional systems beyond the public-facing website were reported compromised. The attackers framed their actions as retaliation for environmental destruction, urging a public boycott alongside the disruptive campaign.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 25, 2018, German energy company RWE experienced distributed denial-of-service (DDoS) attacks targeting its public-facing website, rendering it largely inaccessible by that Tuesday morning. The company filed a police complaint against unidentified perpetrators but confirmed no internal systems beyond the public webpage were compromised. RWE attributed the disruption solely to external flooding of web traffic aimed at overwhelming server capacity. The incident coincided with heightened tensions surrounding RWE’s controversial plans to clear Hambach Forest for lignite mining expansion, where activists had established treehouse encampments to block operations. Police had begun forcibly evacuating protesters earlier that month, pausing briefly after a journalist died during coverage before resuming evictions on September 24.
The mass-circulation newspaper Bild connected the cyberattacks to a YouTube video published days earlier by an account using Anonymous branding and German-language messaging. The video featured a synthesized voice issuing an ultimatum demanding RWE halt forest clearing or face sustained cyber assaults intended to inflict irreversible economic harm. It explicitly threatened to “bring down your web pages” and “bring RWE to its knees,” framing the DDoS campaign as retaliation for environmental destruction while urging a public boycott. RWE did not publicly confirm the video’s linkage to the attacks but acknowledged ongoing public opposition to its mining activities amid resumed police operations at Hambach. The website disruptions represented the first publicly confirmed cyber incident directly tied to protests against RWE’s coal expansion projects.