Cyber Incident Victim: Technische Universität Bergakademie Freiberg (TUBAF)
Date:
Jan 2023
Location:
Germany
Summary
TU Bergakademie Freiberg disconnected from the internet following a cyberattack, with investigations underway to assess the incident's scope and methodology. The university's spokesperson confirmed collaboration with the State Criminal Police Office and external experts during the response. Normal operations continued while systems remained isolated as part of containment measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around January 19, 2023, Technische Universität Bergakademie Freiberg (TUBAF) experienced a cybersecurity incident involving a confirmed cyberattack against its network infrastructure. The university implemented immediate containment measures by disconnecting its systems from the internet to prevent further unauthorized access or potential data exfiltration. A university spokesperson publicly acknowledged the attack on the same day, confirming that investigations were underway to determine the scope of the compromise and the specific methodologies employed by the threat actors. Law enforcement agencies, including specialists from the Saxony State Criminal Police Office (Landeskriminalamt), were engaged to assist in forensic analysis and incident response activities. External cybersecurity experts also joined the investigation to support technical evaluations of the breach.
Despite the disruptive nature of the attack, TUBAF maintained continuity of core academic and administrative operations while operating in a disconnected state from external networks. The university did not initially disclose specific details regarding affected systems, data integrity concerns, or operational disruptions resulting from the isolation measures. No ransomware claims or explicit threat actor attributions were publicly reported in the immediate aftermath. Investigations remained ongoing as of the incident disclosure date, with no confirmed timeline provided for full restoration of internet connectivity or resolution of the security compromise. The university’s public communications emphasized procedural adherence to incident response protocols without elaborating on technical remediation steps or long-term mitigation strategies.