Cyber Incident Victim: Enercon
Date:
Dec 2022
Location:
Germany
Summary
A phishing attack compromised login credentials for 16 teacher and student accounts across multiple schools, with stolen data appearing on the Darknet. As a precaution, nearly 10,000 accounts were temporarily disabled while IT specialists investigated suspicious activity, later reactivating most after verification. The breach targeted Office 365 accounts, exposing access to collaboration tools like Teams and productivity applications including Word and Excel. Security measures were strengthened by mandating 12-character password resets for all affected accounts. Authorities confirmed the incident stemmed from credential harvesting rather than a direct system intrusion, discovered during routine monitoring. Eleven schools ultimately faced impact, though municipal systems remained unaffected due to segregated IT infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 1, 2022, a phishing attack compromised credentials from Office 365 accounts at nine schools in Nuremberg, Germany. Attackers obtained usernames and passwords belonging to 16 teacher and student accounts, subsequently offering them for sale on darknet markets. The compromised system provided access to Microsoft Teams for internal communication and videoconferencing, along with productivity applications like Word and Excel and associated cloud storage. As a precautionary containment measure, authorities disabled nearly 10,000 accounts across the affected institutions—Realschulen, Berufsschulen, and Gymnasien—to prevent potential lateral movement by threat actors. Notification procedures were activated, alerting school administrators, the State School Office, and Ministerial representatives at the Government of Middle Franconia. The municipal administration confirmed its systems remained unaffected due to network segregation between city infrastructure and school IT environments.
Security teams conducted forensic analysis throughout the weekend following the incident, systematically reviewing account activity to identify compromised credentials. By December 12, investigators had cleared most accounts as uncompromised, enabling reactivation of services to restore normal academic operations. Eleven schools were ultimately confirmed as impacted, with additional accounts remaining under scrutiny. The response included mandatory password resets enforcing 12-character complexity requirements for all Office 365 accounts to reduce credential reuse risks. Authorities emphasized the incident originated from credential phishing rather than direct system intrusion, with detection occurring during routine security monitoring rather than external breach notifications. Operational impacts included temporary loss of access to collaboration tools and productivity software until account reinstatement and credential updates were completed.