Cyber Incident Victim: Stadtkrankenhaus Schwabach
Date:
Feb 2023
Location:
Germany
Summary
The Schwabach hospital experienced a cyberattack targeting its externally hosted homepage via a denial-of-service attack, overwhelming the server with excessive requests and causing temporary downtime. While the disruption briefly impacted website accessibility, no internal systems or sensitive patient data were compromised as the attack solely focused on crashing the external server. Although suspicions arose linking the incident to Russian hacker group Killnet—known for retaliatory attacks following Germany's military support to Ukraine—no official evidence confirmed this affiliation. Service was restored within hours with no significant damage beyond user inconvenience.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 1, 2023, the Diakoneo Krankenhaus Schwabach experienced a cyber incident when its homepage became inaccessible in the early morning hours. Unknown hackers executed a Denial-of-Service (DoS) attack by overwhelming the hospital’s external website hosting server with excessive traffic requests, causing it to crash. The attack exclusively targeted the third-party provider’s infrastructure managing the public-facing homepage, not Diakoneo’s internal hospital systems. According to Diakoneo spokesperson Markus Wagner, no unauthorized system infiltration occurred, and threat actors made no attempt to breach sensitive data repositories. Patient records and clinical operations remained uncompromised throughout the incident due to the separation between the targeted external server and core hospital networks. By approximately 11:00 AM local time, technical teams restored the homepage’s availability after mitigating the traffic surge. The primary operational impact involved temporary disruption to public website access, causing user confusion but no lasting technical damage or data exposure.
Contextual reporting highlighted broader geopolitical tensions coinciding with the incident. Germany’s Federal Office for Information Security (BSI) had recently warned of ongoing distributed denial-of-service (DDoS) campaigns against German entities, attributing some activity to the pro-Russian hacker group Killnet. This group publicly threatened retaliation against Germany for pledging Leopard 2 tank deliveries to Ukraine. While the Schwabach attack’s timing and method aligned with Killnet’s announced tactics targeting government, infrastructure, and corporate sectors, investigators disclosed no forensic evidence or official attribution linking the hospital incident to the group. The attack’s limited scope—confined to a non-critical external web server with no lateral movement—resulted in negligible financial or operational consequences beyond transient service unavailability.