Cyber Incident Victim: Erfurt
Date:
Jul 2025
Location:
Germany
Summary
A distributed denial-of-service attack overwhelmed the city's website, rendering it inaccessible after being flooded with up to 4.5 million accesses per hour. The municipal IT office swiftly implemented measures to mitigate the impact, restoring normal service within several hours; existing security protocols ensured no sensitive data was compromised. This incident was part of a broader wave targeting multiple German municipalities and authorities. The State Criminal Police Office and the Thuringian State Computing Center were notified, with the Central Cybercrime Contact Point leading the investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the morning of Tuesday, July 29, 2025, starting at approximately 8:30 AM, the official website of the city of Erfurt, erfurt.de, became unreachable due to a deliberate cyberattack. The attack was identified as a Distributed Denial-of-Service (DDoS) incident, specifically designed to overwhelm the website's capacity. Attackers flooded the site with an extremely high volume of traffic, peaking at around 4.5 million access attempts per hour. This massive influx of malicious requests caused the website to crash, rendering it inaccessible to legitimate users for several hours. The primary impact was the complete unavailability of the city's primary online portal, disrupting public access to information and services hosted on erfurt.de.
The City of Erfurt's Office for Information Technology responded promptly to the incident. They initiated measures aimed at limiting the attack's effects and restoring service. Due to these response actions, the erfurt.de website was successfully brought back to normal operation around 1:00 PM on the same day. The city administration stated that, thanks to pre-existing security precautions, there was no danger to sensitive data resulting from this attack. Investigations revealed that the assault on Erfurt was not isolated but part of a larger coordinated wave of attacks targeting multiple municipalities and administrative bodies across Germany, including Magdeburg, Halberstadt, and the Burgenlandkreis district. Authorities immediately notified the State Criminal Police Office (Landeskriminalamt - LKA) and the Thuringia State Computing Center (Thüringer Landesrechenzentrum). The Central Contact Point for Cybercrime (Zentrale Ansprechstelle Cybercrime) within the LKA has taken charge of the criminal investigation into the incident.