Cyber Incident Victim: Landesregierung Mecklenburg-Vorpommern
Date:
Apr 2023
Location:
Germany
Summary
The state government of Mecklenburg-Vorpommern experienced a temporary outage of its ministerial websites, the public police homepage and the MV-Serviceportal after a distributed denial-of-service attack flooded the servers with excessive requests. IT specialists from the state's data processing center and the CERT M-V team identified the attack, blocked early offenders, implemented further defenses, informed the Federal Office for Information Security and noted that a Russian cyber group claimed responsibility on social media while the police intranet remained unaffected and only the online police report service was temporarily unavailable.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 4 2023 morning, various websites of the Landesregierung Mecklenburg‑Vorpommern became unreachable. Affected sites included the ministries’ webpages, the public homepage of the Landespolizei, and the MV‑Serviceportal. These services are hosted and maintained by the Landes IT service provider, the Datenverarbeitungszentrum (DVZ) M‑V. IT specialists at the DVZ and the state’s Computer Emergency Response Team (CERT M‑V) observed a sharply increased volume of requests early that morning. Initial analysis indicated the traffic was part of an attempt to overload the servers through a massive request flood. In response, a task force was established and the Federal Office for Information Security (BSI) was informed.
Experts from the DVZ and CERT M‑V worked intensively to clarify the events and to prevent further attack waves. They reported having identified and blocked the first attackers early on. Additional technical measures were deployed to repel further attacks. According to the current information from CERT M‑V, a Russian cyber‑group claimed responsibility for the incident on social‑media channels. The interior ministry stated that the police intranet, which supports all internal police operations, was not affected by the attacks. Consequently, police work remained unimpaired and officers were available in all local stations and by telephone. Only the online wache of the Landespolizei, used for filing reports, was temporarily unavailable. For emergencies, citizens were advised to continue using the emergency number 110.
The disruption affected the accessibility of ministry websites, the Landespolizei public homepage, and the MV‑Serviceportal. Internal police systems, including the intranet, continued to operate normally. Members of the public could still reach police services via phone or in‑person visits to stations. The online reporting function remained disabled until further notice. No additional details regarding the duration of the outage or the time of full restoration were provided in the source.