Cyber Incident Victim: Landkreis Mecklenburgische Seenplatte
Date:
Jun 2025
Location:
Germany
Summary
An IT security incident led to the shutdown of the school server affecting multiple schools in Neustrelitz and Demmin, causing disruptions to administration systems, WLAN-dependent devices such as PCs, notebooks, iPads, printers and interactive boards, and telephone services at some locations. The communal IT service provider IKT-Ost AöR is investigating the cause, and officials anticipate that the disruptions will continue for a period while the investigation proceeds.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Wednesday, 18 June 2025, the Schulserver in Demmin was halted after suspicions of an IT‑security incident were raised by the Landkreis Mecklenburgische Seenplatte spokesperson Nils Henke. The halt was initiated while the incident was under investigation, prompting expectations of restrictions in school operations across several locations. Henke communicated that, during the ongoing review, various schools in Demmin and Neustrelitz could experience limitations in their regular activities. The kommunale IT‑Dienstleister IKT‑Ost AöR was tasked with researching the cause of the disruption. According to the Landkreis, the disruption was anticipated to persist at least until Thursday midday. Initial statements did not specify the exact nature of the security event.
The affected institutions include the Regionale Berufliche Bildungszentrum (RBB) Neustrelitz with its external site in Demmin, the Förderschule Neustrelitz, the Volkshochschule Neustrelitz, Haus II des Goethe‑Gymnasiums Demmin, the Volkshochschule Demmin, and the Förderschule „Schule an den Tannen“ in Demmin. Disruptions were reported in administrative systems and in many end‑devices that rely on WLAN or internet connectivity, such as PCs, notebooks, iPads, printers and interactive boards. Telephone service was also noted to be impacted at some of the sites. Nordkurier reported, based on its own information, that the incident might be a cyberattack, although the Landkreis had not yet confirmed this assessment. The statement noted that public authorities and facilities in Mecklenburg‑Vorpommern have recently been targeted by hackers, citing earlier attacks on clinics in the Landkreis Ludwigslust‑Parchim. IKT‑Ost AöR continued its investigation to determine the root cause and to restore normal operations. The Landkreis advised that normal school activities would resume once the IT‑service provider concluded its analysis and cleared the systems for use.