Cyber Incident Victim: Stadtverwaltung Ellwangen
Date:
Apr 2025
Location:
Germany
Summary
Stadtverwaltung Ellwangen reported a cyberattack after irregularities were detected in its IT systems, prompting immediate shutdown of affected devices for forensic analysis. An internal crisis team, including a BSI‑certified IT service provider and external experts, was formed with support from the Baden‑Württemberg cybersecurity agency to assess damage, limit impact, and maintain communication and operational readiness. The administration filed a police report, notified the state data protection officer, and informed its cyber insurer. While most municipal services remain operational via email and phone, school‑related IT applications face usage restrictions, and efforts continue to restore full functionality.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On 24 April 2025 the city administration of Ellwangen detected irregularities in its IT systems and immediately initiated comprehensive security measures. As a precaution, conspicuous systems were shut down for forensic investigation and remain under ongoing examination. An internal crisis team was formed, comprising a BSI‑certified IT service provider, additional specialist experts and support from the Cybersecurity Agency Baden‑Württemberg. The crisis team undertook all necessary steps to assess the extent of the damage, limit it to a minimum and maintain stable internal and external communication capabilities and operational readiness, prioritising safety over speed. The administration filed a police report without delay and has been in regular contact with the investigative authorities. The data protection incident was reported in a timely manner to the state commissioner for data protection and freedom of information, and the event was also notified to the city’s cyber insurance provider.
According to the latest information, most of the city administration’s systems continue to operate without disruption and are under continuous monitoring; the administration remains reachable by e‑mail and telephone and all municipal services can be provided at the town hall as usual. In contrast, the municipal schools experience restrictions in the use of IT‑based applications, and the affected institutions have been directly informed. All involved parties are working intensively to clarify the situation and to restore normal school operations as quickly as possible, with any new findings or developments to be communicated through the established channels. Press inquiries are directed to Dr. Anselm Grupp, press spokesperson (telephone 07961 84‑246, e‑mail anselm.grupp(@)ellwangen.de) and Jochen Trollmann, head of the main office (telephone 07961 84‑216, e‑mail jochen.trollmann(@)ellwangen.de).