Stadtwerke Landsberg names eight service lines that stayed up while its office IT was encrypted
The Bavarian city utility was encrypted in the night into September 1 and told customers six days later that power, water, heating and five other operations kept running, while it still cannot rule out that customer bank details were taken.
The Watch · Security desk
What happened
- Stadtwerke Landsberg KU, a city-owned utility in Bavaria, says criminals encrypted its central IT systems in the night into September 1.
- The utility cannot rule out access to or theft of customer names, addresses, landline and mobile numbers, email addresses and bank account details.
- No ransomware group has been named, and the utility has not said whether an extortion demand was received.
Why it matters
- What doesn't add up contradiction The claim that supply was untouched and the admission that forensics is unfinished sit in the same document, and the notice never describes the boundary that held, so the segmentation outcome rests on the operator's account until the investigation closes.
- What it limits constraint A peer utility can copy the containment sequence from this notice, but the notice names no group and no indicators, so there is nothing to hunt with.
- Who's exposed exposure The fraud risk transfers to customers while the forensics are open, and the utility's own guidance assumes attempts on their accounts, down to test debits of tiny amounts.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
The containment sequence came out of a plan the utility already had. Stadtwerke Landsberg cut every internet connection and shut systems down to reach what it called a safe and stable state [5]. A crisis team has been working nearly round the clock, and external cyber security specialists were brought in to analyse the scope of the attack and support the rebuild [6]. For many processes the utility switched to fallback procedures it had prepared in advance, and it says the rebuild of affected systems is on schedule [14]. The incident was reported to the responsible authorities within the deadline and a criminal complaint was filed [15].
Staff "are currently only available to a limited extent by phone and email", the utility said [4], and the notice gives one number, 08191/9478-0, for urgent inquiries [3]. Six days passed between the night of the attack and the customer notice [24].
Eight operations are listed as unaffected [13]: the electricity grid, the water supply, the sewage plant, district heating, the fibre network, the charging infrastructure, the Inselbad and the parking garages [2]. The notice does not explain how those systems were kept separate from the IT that was encrypted [11]. Forensic examination of how the attack unfolded is still running [7].
The utility says it cannot conclusively assess whether personal data was accessed or exfiltrated, and it cannot rule it out; the categories in scope are name, first name, address, landline and mobile numbers, email address and bank account details [7][8]. Its advice to customers: check statements for very small debits, because criminals often run a test transaction before a larger one, and report anything suspicious to the bank and to the data protection officer [16]. Payment details for the utility have not changed, and it says it will never contact customers directly to request sensitive data such as credit card information [17].
For anyone else running a Stadtwerk, the notice is thin where it counts. No ransomware group has been named and the utility has not said whether it received an extortion demand, according to The Record [9]. Germany's BSI has repeatedly identified ransomware as one of the country's most serious cyber threats [18].
Landsberg was not the only German infrastructure story that day. The federal government formally blamed Russia for a drone attack at Leipzig/Halle airport, and saboteurs struck two power substations [20]. Investigators found improvised devices near the Turnow-Preilack substation in Brandenburg, where one caused a short circuit without significant disruption to public supply. Hours later, several power-plant units briefly went offline after an attack at Amprion's Rommerskirchen substation in the west, without threatening grid stability [21]. Police arrested a 48-year-old man the next day over sabotage at power installations in Brandenburg, North Rhine-Westphalia and Saxony, and two handwritten letters claiming sole responsibility cite the writer's opposition to electricity generation from fossil fuels [23]. The Record reported that there is no indication the Landsberg hack is connected to any other incident [22].
A municipal utility serving Kamen, Bönen and Bergkamen in North Rhine-Westphalia was hit in late June, internal systems were disrupted for weeks, and the operator later said attackers may have accessed older backups containing personal data [19].
What to watch
- Whether forensics turns "cannot be ruled out" into a confirmed exfiltration, or Landsberg customer data appears on a leak site.
- Whether a ransomware group claims the encryption or an extortion demand becomes public.
- Whether the rebuild holds to the schedule the utility says it is meeting, or drags out like the Kamen case.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption55
- Hype gap+22
- Incentives68
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Stadtwerke Landsberg KU said it fell victim to a criminal cyberattack in the night into September 1, after which central IT systems were encrypted.
- [2]
The notice says operation of the electricity grid, the water supply, the sewage treatment plant, district heating, the fibre network, the charging infrastructure, the Inselbad and the parking garages are not affected by the attack.
- [3]
The notice says staff are currently only reachable to a limited extent by phone and email, and gives the number 08191/9478-0 for urgent inquiries.
- [4]
Staff "are currently only available to a limited extent by phone and email", the utility said.
- [5]
Immediate measures taken on the basis of the utility's emergency plans included cutting all internet connections and shutting down systems to establish a safe and stable situation.
- [6]
The utility's crisis team is active and working nearly round the clock, and external cyber security specialists were engaged to analyse the extent of the attack and to support the rebuilding of affected IT systems.
- [7]
Specialised IT forensics are examining how the attack unfolded; the utility says it cannot yet conclusively assess whether and to what extent personal data was accessed or exfiltrated, and that it cannot rule this out.
- [8]
Customer data potentially affected includes surname, first name, address, telephone number, mobile number, email address and bank account details.
- [9]
The operator did not identify a specific ransomware group that may have committed the attack, nor say whether it has received an extortion demand.
- [10]
Stadtwerke Landsberg is a city-owned municipal utility in Bavaria and disclosed the encryption of its central IT network on Monday.
- [11]
The notice does not explain how the affected IT systems were separated from the operational systems it lists as unaffected.
- [12]
The utility's customer notice is issued under Art. 34 GDPR and is dated Landsberg, 07.09.2026.
- [13]
The notice lists eight operations as unaffected.
- [14]
The utility says it activated prepared fallback solutions for many processes and that the rebuild of affected systems is on schedule.
- [15]
The utility says the incident was reported to the responsible authorities within the deadline and that it filed a criminal complaint.
- [16]
The utility advises customers to check bank statements regularly including for very small amounts, because criminals often make test debits before larger ones, to inform their bank immediately of suspicious transactions and to report them to its data protection officer.
- [17]
The utility says its bank details for transfers have not changed and that it will never contact customers directly to obtain sensitive data such as credit card information.
- [18]
Germany's federal cybersecurity agency, the BSI, has repeatedly identified ransomware as one of the country's most serious cyber threats.
- [19]
A similar attack on a municipal utility serving Kamen, Bönen and Bergkamen in North Rhine-Westphalia took place in late June; internal systems were disrupted for weeks and the operator later said attackers may have accessed older backups containing personal data.
- [20]
The Landsberg attack coincided with the German government formally blaming Russia for a drone attack at Leipzig/Halle airport and with saboteurs striking two power substations on opposite sides of the country.
- [21]
Investigators found improvised devices near the Turnow-Preilack substation in Brandenburg, where one device caused a short circuit but no significant disruption to public supply; hours later an attack at the Amprion substation at Rommerskirchen in the west briefly knocked several power-plant units offline without threatening the stability of the grid.
- [22]
There is no indication the Landsberg hack is connected to any other incident.
- [23]
On Tuesday police arrested a 48-year-old man in connection with acts of sabotage at power installations across Brandenburg, North Rhine-Westphalia and Saxony, and two handwritten letters claiming sole responsibility cite the perpetrator's opposition to electricity generation from fossil fuels.
- [24]
Six days elapsed between the night of the attack and the customer notice.
Sources
2 independent publishers whose own reporting we read for this story.
- Stadtwerke Landsberg KU
stadtwerke-landsberg.de
1 article · September 10, 2026
- therecord.mediaCyberattack encrypts systems at Bavarian municipal utility
1 article · September 8, 2026
Topics and entities
Topics
- IT/OT segmentation
- Ransomware
- Infrastructure sabotage
- Critical infrastructure security
- GDPR breach notification
Entities
- Alexander Martin
- GDPR
- Federal Office for Information Security (BSI)
- Recorded Future News
- Stadtwerke Landsberg KU