Cyber Incident Victim: Gemeinde Ostercappeln
Date:
May 2025
Location:
Germany
Summary
The town hall of Ostercappeln has been incapacitated since Friday due to a criminal ransomware attack that halted all digital services. The telephone system was restored on Wednesday, allowing staff to be reached at their usual numbers, while IT systems were immediately isolated to protect data security. Officials say it remains unclear whether any data were exfiltrated, and the investigation is ongoing with police specialists and external experts working to assess the damage and rebuild the computers, a process that may take weeks. In the meantime, officials are exploring a short‑term alternative system for internal use to enable digital work, though current operations are largely analog. The municipality has confirmed it will not pay any ransom, noting that no official ransom demand was received.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Friday the town hall of Ostercappeln became the victim of a criminal cyber attack that immediately disabled its IT infrastructure. In response the administration isolated all affected systems to protect data security and privacy. The attack prevented the provision of any digital services from the municipal offices. By Wednesday the telephone system had been restored to full functionality, allowing staff to be reached again under their usual numbers. Officials confirmed that the isolation measure was taken straight after the incident was detected. No details about possible data exfiltration were available at that mid‑week point, with further checks promised. The municipality began working with a specialised police unit and external IT experts to assess the damage.
The attackers employed ransomware, which locks access to data or systems and demands payment for decryption, although no official ransom demand was received. Mayor Erik Ballmeyer stressed that the community would not pay any ransom. Rebuilding the compromised computers requires a complete reinstallation, a process that the mayor warned could last several weeks. Consequently online municipal services remain unavailable and staff have been instructed to work with analog methods while alternatives are examined. Experts are currently evaluating whether a temporary internal system can be set up to enable limited digital work in the short term. The ongoing collaboration with law enforcement and specialists aims to both restore operations and determine the full scope of the breach. No further specifics about the attack vector or the identity of the perpetrators have been disclosed in the reported information.